k8s.yaml

##  __  __ _       ___ ___
## |  \/  (_)_ __ |_ _/ _ \
## | |\/| | | '_ \ | | | | |
## | |  | | | | | || | |_| |
## |_|  |_|_|_| |_|___\___/
## 

## https://min.io/ + https://github.com/minio/minio + https://hub.docker.com/r/minio/minio
## https://github.com/Tob1as/docker-minio + https://hub.docker.com/r/tobi312/minio

## https://kubernetes.io/docs/reference/kubectl/cheatsheet/
## kubectl apply -f k8s.yaml

---

## ConfigMap:
## https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/

apiVersion: v1
kind: ConfigMap
metadata:
  name: minio-env-config
  namespace: default
  labels:
    app: minio
data:
  #TZ: "Europe/Berlin" # not working
  #MINIO_USERNAME: "minio"
  #MINIO_GROUPNAME: "minio"
  #MINIO_UID: "1000"
  #MINIO_GID: "1000"
  MINIO_SERVER_URL: "https://minio.example.com"
  MINIO_BROWSER_REDIRECT_URL: "https://minio-console.example.com"

---

## Secret:
## https://kubernetes.io/docs/concepts/configuration/secret/

## values encode in base64, examples: 
## - Linux shell/bash: "echo -n 'value' | base64"
## - Windows PowerShell: "[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('value'))"
## - Result for value: dmFsdWU=
## - example for (tls-)files see Ingress!

apiVersion: v1
kind: Secret
metadata:
  name: minio-env-secret
  namespace: default
  labels:
    app: minio
data:
  MINIO_ROOT_USER: bWluaW8=            # minio
  MINIO_ROOT_PASSWORD: bWluaW8xMjM=    # minio123
  #MINIO_ACCESS_KEY: bWluaW8=          # use MINIO_ROOT_USER
  #MINIO_SECRET_KEY: bWluaW8xMjM=      # use MINIO_ROOT_PASSWORD

---

## add own cert CAs for Minio

#apiVersion: v1
#kind: Secret
#metadata:
#  name: ca-files-secret
#  namespace: default
#type: Opaque
#data:
#  my-ca.crt: <my-ca.crt in base64>
#  other-ca.crt: <other-ca.crt in base64>
#
#---

## Deployment/Pod:
## https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
## https://kubernetes.io/docs/concepts/workloads/pods/
## https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
## https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
## https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line

apiVersion: apps/v1
kind: Deployment
metadata:
  name: minio
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio
  strategy:
    type: Recreate
  template:
    metadata:
      name: minio
      labels:
        app: minio
      annotations: {}
    spec:
      #imagePullSecrets:
      #- name: regcred
      restartPolicy: Always
      containers:
      - name: minio
        #image: minio/minio:latest
        image: tobi312/minio:latest
        imagePullPolicy: Always
        args:
        - server
        - --address
        - :9000
        - --console-address
        - :9001
        - /data
        envFrom:
          - configMapRef:
              name: minio-env-config
          - secretRef:
              name: minio-env-secret
        ports:
        - containerPort: 9000
        - containerPort: 9001
        readinessProbe:
          httpGet:
            path: /minio/health/ready
            port: 9000
          initialDelaySeconds: 30
          periodSeconds: 20
        livenessProbe:
          httpGet:
            path: /minio/health/live
            port: 9000
          initialDelaySeconds: 60
          periodSeconds: 20
        resources:
          requests:
            memory: "256Mi"
            cpu: "0.5"
          limits:
            memory: "1Gi"
            cpu: "1.0"
        volumeMounts:
        - mountPath: /data
          name: minio-data
        - mountPath: /root/.minio/certs/CAs  # https://docs.min.io/docs/how-to-secure-access-to-minio-server-with-tls.html#install-certificates-from-third-party-cas
          name: cacerts
      volumes:
        - name: minio-data
          persistentVolumeClaim:
            claimName: minio-data
        - name: cacerts
          secret:
            secretName: ca-files-secret
            defaultMode: 0644
            optional: true

--- 

## Service:
## https://kubernetes.io/docs/concepts/services-networking/service/

apiVersion: v1
kind: Service
metadata:
  name: minio
  namespace: default
  labels:
    app: minio
spec:
  ports:
    - name: "minio"
      port: 9000
      targetPort: 9000
      protocol: TCP
    - name: "minioconsole"
      port: 9001
      targetPort: 9001
      protocol: TCP
  selector:
    app: minio

---

## CertManager for Ingress (if use this then comment out "Secret for Ingress"):
## https://cert-manager.io/docs/ (https://github.com/jetstack/cert-manager)
## Installation needed: kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml

#apiVersion: cert-manager.io/v1
##kind: ClusterIssuer
#kind: Issuer
#metadata:
#  name: certmanager-ingress-nginx
#  namespace: default
#spec:
#  acme:
#    email: email@example.com
#    server: https://acme-v02.api.letsencrypt.org/directory
#    privateKeySecretRef:
#      name: ingress-tls-secret
#    solvers:
#    - http01:
#        ingress:
#          class: nginx

---

## Secret for Ingress (if use this then comment out "CertManager for Ingress"):
## https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

## convert ssl files to base64, examples: 
## - Linux shell/bash:
##   - for i in $(find . -type f -regex ".*/.*\.\(crt\|key\|pem\)"); do echo -e "\nEncode-File $i:" ; cat $i | base64 -w0 ; done
##   - Tip: to save in file add "> ssl_convertinbase64.txt" to end of command
## - Windows PowerShell: 
##   - Get-ChildItem -Path $scriptPath -Recurse -Include *.crt,*.key,*.pem | Foreach-Object { $filename = $_.BaseName+$_.Extension ; Write-Host "$filename :" ; [System.Convert]::ToBase64String((Get-Content -Encoding Byte -Path .\$filename))}
##   - Tip: to save in file add " |  Out-File -Encoding utf8 -FilePath .\ssl_convertinbase64.txt" to end of command

apiVersion: v1
kind: Secret
metadata:
  name: ingress-tls-secret
  namespace: default
  labels:
    app: minio
data:
  tls.crt: <ssl.crt in base64>
  tls.key: <ssl.key in base64>
type: kubernetes.io/tls

---

## https://kubernetes.io/docs/concepts/services-networking/ingress/
## https://kubernetes.github.io/ingress-nginx/ + https://github.com/kubernetes/ingress-nginx/

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-minio
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    #nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    #cert-manager.io/cluster-issuer: ingress-tls-secret
    #cert-manager.io/acme-challenge-type: http01
    ## https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/
    #nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    #nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
spec:
  tls:
  - hosts:
    - minio.example.com
    - minio-console.example.com
    secretName: ingress-tls-secret
  rules:
  - host: minio-console.example.com
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: minio
            port:
              #name: minioconsole
              number: 9001
  - host: minio.example.com
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: minio
            port:
              #name: minio
              number: 9000

---

## Storage/Volume: 
## https://kubernetes.io/docs/concepts/storage/
## https://kubernetes.io/docs/tasks/configure-pod-container/configure-persistent-volume-storage/

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: minio-data
  namespace: default
  labels:
    app: minio
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 50Gi
  storageClassName: manual

--- 

## StorageVolume: 
## https://kubernetes.io/docs/concepts/storage/
## https://kubernetes.io/docs/tasks/configure-pod-container/configure-persistent-volume-storage/

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  persistentVolumeReclaimPolicy: Delete
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/k8sdata"

---

# or with https://github.com/rancher/local-path-provisioner

#apiVersion: v1
#kind: PersistentVolumeClaim
#metadata:
#  name: minio-data
#  namespace: default
#spec:
#  accessModes:
#    - ReadWriteOnce
#  volumeMode: Filesystem
#  resources:
#    requests:
#      storage: 100Gi
#  storageClassName: local-path