mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Sonnet 5
7206022a2b
rootUser/rootPassword were left unset, relying on the chart's auto-generation - but ArgoCD renders Helm via 'helm template', which doesn't support the lookup() function charts use to preserve an existing generated secret across upgrades. With selfHeal: true, every single sync generated a BRAND NEW random root password, immediately invalidating whatever credentials were stored in the home cluster's Vault for the backup/CronJob consumers (vault-raft-snapshot, 3x CNPG barmanObjectStore, nextcloud-pvc-sync) - confirmed live: all of them failing with 'Access Key Id does not exist' right after being fixed, because the password had already rotated out from under them again. Fixed by pointing at a pre-existing Secret created directly on the VPS cluster (kubectl, not git - this cluster has no Vault/ESO of its own). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
70 lines
2.7 KiB
YAML
70 lines
2.7 KiB
YAML
# MinIO on the VPS - shared backup-receiver bucket for the vps-standby site.
|
|
# Standalone mode: single node, single VPS disk, no erasure coding needed here -
|
|
# this is a backup *copy*, not itself something requiring HA.
|
|
#
|
|
# Root credentials come from a pre-existing Secret created manually on the
|
|
# VPS cluster (kubectl, not git - matches how other VPS bootstrap secrets
|
|
# are handled, since this cluster has no Vault/ESO of its own to source an
|
|
# ExternalSecret from):
|
|
# kubectl -n minio create secret generic vps-minio-root-secret \
|
|
# --from-literal=rootUser=<user> --from-literal=rootPassword=<password>
|
|
#
|
|
# Originally left rootUser/rootPassword unset entirely, relying on the
|
|
# chart's auto-generation - broke in a way that took a while to trace:
|
|
# ArgoCD renders Helm charts via `helm template`, which does NOT support
|
|
# the `lookup` function charts normally use to preserve an existing
|
|
# auto-generated secret across upgrades (that only works with real `helm
|
|
# upgrade`). Every ArgoCD sync (selfHeal: true, so this means constantly)
|
|
# re-rendered a BRAND NEW random root password, immediately invalidating
|
|
# whatever credentials were stored in the home cluster's Vault for the
|
|
# backup/CronJob consumers (vault-raft-snapshot, CNPG barmanObjectStore
|
|
# x3, nextcloud-pvc-sync) - confirmed live 2026-08-18, all of them failing
|
|
# with "Access Key Id does not exist" despite having just been fixed.
|
|
mode: standalone
|
|
|
|
existingSecret: vps-minio-root-secret
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: local-path
|
|
size: 150Gi # budget out of the VPS's 360GB disk; leaves room for Phase 2 standby PVCs
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Buckets used by the backup/standby plumbing (Phase 1b / Phase 2). Created on
|
|
# first deploy; safe to append to as later phases land.
|
|
buckets:
|
|
- name: vault-raft-snapshots
|
|
policy: none
|
|
purge: false
|
|
- name: cnpg-backups
|
|
policy: none
|
|
purge: false
|
|
- name: nextcloud-files
|
|
policy: none
|
|
purge: false
|
|
|
|
# No ingress here - MinIO is reached over Netbird (while home is up) or from
|
|
# workloads inside the vps-standby cluster itself. It never needs to be public.
|
|
ingress:
|
|
enabled: false
|
|
|
|
# NodePort so home-cluster CronJobs (vault raft snapshots, CNPG barman backups,
|
|
# Nextcloud PVC sync) can reach this over the Netbird tunnel at
|
|
# <VPS_NETBIRD_IP>:30900 - single-node cluster, so NodePort is simplest here.
|
|
# Verify the exact key path against `helm show values minio/minio` for the
|
|
# deployed chart version (5.4.0) before applying - not confirmed live.
|
|
service:
|
|
type: NodePort
|
|
nodePort: 30900
|
|
|
|
metrics:
|
|
serviceMonitor:
|
|
enabled: false # no Prometheus on the VPS cluster (out of scope for this build)
|