minio.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: minio
  namespace: kube-system
spec:
  interval: 5m
  chart:
    spec:
      # renovate: registryUrl=https://charts.min.io/
      chart: minio
      version: 5.4.0
      sourceRef:
        kind: HelmRepository
        name: minio-charts
        namespace: flux-system
      interval: 5m
  values:
    image:
      repository: quay.io/minio/minio
      tag: RELEASE.2025-01-20T14-49-07Z@sha256:ed9be66eb5f2636c18289c34c3b725ddf57815f2777c77b5938543b78a44f144
      pullPolicy: IfNotPresent
    mcImage:
      repository: quay.io/minio/mc
      tag: RELEASE.2023-01-11T03-14-16Z
      pullPolicy: IfNotPresent
    mode: standalone
    rootUser: ${SECRET_MINIO_ACCESS_KEY}
    rootPassword: ${SECRET_MINIO_SECRET_KEY}
    users:
    - accessKey: ${SECRET_THANOS_S3_ACCESS_KEY}
      secretKey: ${SECRET_THANOS_S3_SECRET_KEY}
      policy: readwrite
    - accessKey: ${SECRET_VOLSYNC_MINIO_ACCESS_KEY}
      secretKey: ${SECRET_VOLSYNC_MINIO_SECRET_KEY}
      policy: readwrite
    - accessKey: ${SECRET_CNPG_MINIO_ACCESS_KEY}
      secretKey: ${SECRET_CNPG_MINIO_SECRET_KEY}
      policy: readWrite
    - accessKey: ${SECRET_FORGEJO_MINIO_ACCESS_KEY}
      secretKey: ${SECRET_FORGEJO_MINIO_SECRET_KEY}
      policy: readWrite
    persistence:
      enabled: true
      existingClaim: "nfs-minio-pvc"
    ingress:
      enabled: true
      ingressClassName: nginx-internal
      hosts:
        - minio.k.${SECRET_DOMAIN}
      tls:
        - secretName: minio-cert
          hosts:
            - minio.k.${SECRET_DOMAIN}
    consoleIngress:
      enabled: true
      hosts:
        - mc.k.${SECRET_DOMAIN}
      tls:
        - secretName: minio-console-cert
          hosts:
            - mc.k.${SECRET_DOMAIN}
    securityContext:
      enabled: false
    resources:
      requests:
        memory: 350Mi
        cpu: 25m
      limits:
        memory: 1500Mi
    tolerations:
      - key: "arm"
        operator: "Exists"
    metrics:
      serviceMonitor:
        enabled: true