squash all

Mostly copied over from my old repo and modified for app of apps.
Cleaning up the mess from migration

Signed-off-by: gwg313 <gwg313@pm.me>

minio/certificate.yaml

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: minio-cert
+  namespace: istio-system
+spec:
+  secretName: minio-cert
+  issuerRef:
+    name: letsencrypt-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - s3.gwg313.xyz
+    - s3-console.gwg313.xyz

minio/gateway.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: minio-gateway
+  namespace: minio
+spec:
+  selector:
+    istio: gateway
+  servers:
+    - port:
+        number: 443
+        name: minio-api
+        protocol: HTTPS
+      hosts:
+        - s3.gwg313.xyz
+      tls:
+        mode: SIMPLE
+        credentialName: minio-cert
+    - port:
+        number: 443
+        name: minio-console
+        protocol: HTTPS
+      hosts:
+        - s3-console.gwg313.xyz
+      tls:
+        mode: SIMPLE
+        credentialName: minio-cert

minio/minio-secrets-sealed.yaml

@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: minio-auth
+  namespace: minio
+spec:
+  encryptedData:
+    root-password: AgCvWTrmBHyov/pb/N4PoK20fwAoH1zDh+MFUGqA60QYiXYLTMMax5fjbOd4NafbpFo18NKen0dEKuJGec2NrHTMq7oM+46+PnzrSIuw1If1PHeU5vi0tYSZSI6EeiwUOlz5HZUV19X4y/eHkFFTGjqxaIRRaelCFFwIFwRh17WgBrm2IfR5GUka9HFYPYYrDpXqlbSxV6en1UPOkzyLUqvS6QbdV5XP0Lb9Yd/3wybpIMtkLloMDQ4r8svYQCHlAHmpLDDQHr76060I5hSf4G7Sf7OtQL/ajfyXjPOHLpBNZjEhRGXkevaiBS75JqeJEBnJ2R1UmaA6sjU5kgcPy0ZsgcznI4Gga4e5lfOKIZz0P85WW6oZZKtKQ4HbZ2+nbrlgleYeWB1CqaqWyonK7GLMG8HpSwVEtUwKZD5AOs0IOC83jjDFfWcJbEsbkjIwN+LQzCzW2+3fkeJTZ/6oybIYXBjKfek9+l99oPhkGuqY0QTh7beFfo7EMqLP1kPiqKaMkYyVtL2l78hDtp0D+6urgF31c5bjUjs5wpWFxnmGwkj9prAjn5gqHetHT7jcob0Gj08wnRip7/gL17VwS++1e6DkInvWatU8I/R29VxEPV9GzsXHQmRCJp64am9VaNuFa13Ot5OgImrt4/zrDSz7ERazTuWeq3hE5swwMFRudW+d04PX7Hc2ypSSnNThhq1GGhRsnmNmN5YK0TcdqBhXvoj6/EXiBCrZ
+    root-user: AgC2+0bGtunOwD/FrXYlsVaAFguyzSkjikinYoAy8tUjskZQmiCukls/938JMdI0ZAFl9XEmAaEizDcyGBjxso+hxRO4A33WUoPyMx+2/JBCVNiCxtlszNk6c2+eIJ2khRE3JtY7lNPUcVJiJr7t9zLeVfzBeyBEO2STmLZcuqw1b55KuadMxbjkK6Zt+yH0sQsu6jtrfM0oo+dBHETI/1xIxq9kwn75fkAfHDU4Tz0bQ1HILr226Eo1NRHtLN5S+Thi0fDnhVSHTMPr1khr39eu9jQDegiKXl98Ps3iodM4cSb9ic+hn7bCsMBcM4Y+X9ZEBeAS/8S97Vi/1izuHDhK3a3gZYznl/8nor38GkuWx/c3oocy7fkFGe0dmvk4y+aXUal32su3gnG8mLK5GwCMoAE+CKh0skN/boXLYOahPAfNLTBpP4UJBP6sgf+oKktWMTgJ1NJuvIoEFZM+s6eo/8hbG+x9+ACKaco80UT1dd545eEppMVfjh05Z3fzWi0Ro096tw/qQZp+Me3MyWgX1KiLUxykhE80brZ7+NUVm/USpoHGY/jogHiF11mV/7hL2cKea/Tuz+BRXh9CgPGb4MYr+O5lGewEAmlJAFOjWqmVNG6eezvzJKug/uzXKNNblEYnVNXYYJanQFLQtDrXMvz18fULoT7EiV1THvV9bUOtxu5v5IF8eK7F+Vqma5itjUBq5t0=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: minio-auth
+      namespace: minio

minio/secrets-sealed.yaml

@@ -0,0 +1,18 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: minio-iscsi-auth
+  namespace: minio
+spec:
+  encryptedData:
+    discovery.sendtargets.auth.password: AgBmscqh2S8TPLgLJn+Wigsd0OAgPE4fHB9Me5dX6BTClvssIjg/fJJk0dFa3mxUcf44D6BkLpa6kquFHhYx7Ga7gNDB0SpLpL63jt8UVusEutE2+onTTh4saWGeQAmJHjdKvdWqdRFWSn+P1BWt6KqRAar+pPESCy010ZFC6Do/EJmxlKcwp2R/wlMg3VPOA25aHWwr8xjXgGIiAX3fHp8A5IWa3beqE26OfK1QixlVJUs4kr+VIIPLbyu8SlidcRNk0f7J5t+A6xwQTshjz3+BZiuvqU1vAfeVCbjtm0kTCohLlVTOw+TCCy28hd1rYdjUL1WNDy5+Z8AZdMyvQacwvuoygOZY2gQiuiA4dll51DIx3F+On43lAxg+UEMI2g8/Lk5G74+tHTm0xJ/UPVAg7aaru9j7XEoOtGuj1BvlFoQ04KDBynbMe9SRdkn7bC+ankKvs6tb9vaRGj8XNldd1zxWP3NX7cwEo4t2tvWJNtg9OKFrNRgajFNo/35N7NH0swtpLDLAOCGp4oQTvTEf74zniP5zaV9V7feO3F/t9Ha+N0PA/JdftQ++EHHnlI/eTRhJtH35vRHM1BYeVcNsrQMUIi7G3hx3Vwpu5iXNciMCFs3YDxwyYG6g4wSr1XLWT/zZW4R1jDx4ldYmGajF8f8lEAe5h/dilk44VVMsTAop5BXhlJykfEgCqf77hXIK8SQLpcWUvsgbaqeu/zGT
+    discovery.sendtargets.auth.username: AgBg+3rIcTT0tA479+DLobTdxmUZAkVfhcaweZlX5b8K4zRZFWuxFvZoVdJkL5O7dDR0F9lqp8MTdqWHyJ9uq5D/ei3cJb1CRHte5/Q7EkkcS1brMFP6sub+VXhDHMVZ8T4rC8XxdSZcGjyG3AH1wyqxNZ+C3vF7/Ngy6xBrukaS+6l9lwY/g4n7Q2+Up9i7s1nroBUM/nSgLCL5sVhvhgZ31r2aMxx8bXJT5/9JfAZL73hhInISCD8rjir0wj7mAFnrjfKxaNh2sEOZhXOyKPcgGk+ovDBeySZSF9mclV8iHXoHr/museX34oyvQejkkMGthMmL52PhZbXIlXwwIuf5n9bnPmMtPRQ/aovPHzmQDI+ks7ft4WfLnlX1Y16eQ/LVjT0ZD/0X7n4CE57utUAhdlVraxrFtr3YoPKsdLYfz/We3RGpeLWiW7JMYnmkc9j9XMHBwx91y0Ba3ssj9KSijtPVOzRqct3NoBJ+s1FpjbljIPS8iQKUYdHcSIhVjYIAebLMctZyxVG/cW1KbSPEeOo6MQ1drOFsvXOfUeYn0PiGcSmRWuJ8CJZxh+Y2YKUDf0eqJQCs8SlDucVcYvvjYM06tZXoGR6XuGqUnbzxguzTX6dbzR8mpfniAiQkIBkBVezdOvqh3OiOPfhFkVEX6V47UnZhfe9IA5RR9NehuUw9OVIZ6FGz1Adu1EeFJ6c0ikCSUg==
+    node.session.auth.password: AgCgA17eF7kgdTYGuBJ12HtWAdwQKluvmirOCpPWjIiGU7YHGfEQxIS3MEmuI7/Z0oNB/SYgqZwnS56AZ8OUEf6L90uYhfkN8VV79QJxZlk4EXSgu6EfiKjoYU0uwQSnqDVSOYG9VxEro+tgeYj4hpqag9MIfULX6kTbDll2bcuq/eXDl4QijNveU+wqMzRz5t/c7MSdcacJO9l3DvXvnZEUpKydw9TKyPBGyFB5Lsjlf9Lkxf8+kqScS7eC849LrDAUiFMktOrwKsK4gk7JX7Dvuc8n9iDOjGPjgv/mz1xOP9mEnQqpP7d9JIR7WLubl+MPeXwpTA4cR2/VA6TWV86hbmCuYGckPX80+DEW26jAHxmaSIk3U4ZOY11eiYGieTr7Irlx4L7TFukwB8g9Cf8io6pQJU2wA9vflF4s/yZOXiAqP4sit1qd4Z0/DR5n/7DbhOs0qKOHbiUTujmw36ewmfJ8IDxq6WzomjuJz2ezaVTVkdSXDcchyCg3yVutjqaAw+O1XNJdgtoAZXhh0dr6hiTLy1oi3nKyVy/EYn3mxZg8S/ixLyS3a6XcoAqsfpdXf2tirfrMG5OACZgLoi3+cYthgrpi1rrbIR23MSFuvAcDUjLKYiFbq2BJJUpuACeio2VMrgCC/Cb5xXS4Rprg4wUEz0wAB5vUH2NrkDTqMTofEw3EdhB5SfjLu5+HlBmasmlwgbyhmrSr0V609fog
+    node.session.auth.username: AgAUXhbc4OXDg1DgbJeJ3Q6ANfa6SKyQshDJeutnrHFJ8g5Ne59OzkMrbEafDEp+BmPtLA9gV/wYhieMWgsdtKQiYiEsBqqOwT4K/bxV0zTo1wUG5yfwC7QSPYssdOKTcDHix0sHB+V4e8n1HO8Y6gfZaqkrK65WairLtMWLF0fmCYZ7peMa8FGu94n0uDL1iglXdnp9CphFjMeaghHRDNUsvWKXnlP4wa+VsY3NQqGqiulfhRhFUyjCtR496VztD+JMtUdh4wp0xN0HRZxkTAfC0xcVuXBnTZgDv7OQ8lb1EOqjMmVaI9Xd9+JA1HYEwqSizkzP6EnOhQZgBviJfjYiLLqwZTqpIaaOtaQ0QO+ws65smG8TlRMfzsiW0NfpzwY3E3ZSUewp0Lq6wnKdB/7DeLQKbLJ2mUV/Xes1AHjJAcCgdVoVmNooepKTe9r6Ysvdab1UelYjbsgJB178Yohlhe0zAGNiBGjDwc9Y87ZzL8KTySiihl0u6/HIEJKYAhrivAXLDu/rwtFBGvpM0VjyOs3/2OhUIJ/a2ln8+xPXfqeGeAXzXmU4tRwoeS9df95gxyFnV+SrYT3Vv64CQvCbfnYtG+mlPznxiwRAdYBcjOuHm1GmfbeD0jgJeIMpLl91eg70pVa3RNYagA67bclF0ImXQQd7MFF2plUyH5DAq2yMxmVBs9Jx+7Adr60VomzVLr5ymw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: minio-iscsi-auth
+      namespace: minio
+    type: kubernetes.io/iscsi-chap

minio/storage.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: minio-pv
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: minio-iscsi
+  iscsi:
+    targetPortal: truenas.local.gwg313.xyz
+    iqn: iqn.2005-10.org.freenas.ctl:minio
+    lun: 0
+    fsType: ext4
+    readOnly: false
+    chapAuthDiscovery: true
+    chapAuthSession: true
+    secretRef:
+      name: minio-iscsi-auth
+      namespace: minio
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: minio-data
+  namespace: minio
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Gi
+  volumeName: minio-pv
+  storageClassName: minio-iscsi

minio/virtualservice.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: minio-console
+  namespace: minio
+spec:
+  hosts:
+    - s3-console.gwg313.xyz
+  gateways:
+    - minio-gateway
+  http:
+    - match:
+        - uri:
+            prefix: /
+      route:
+        - destination:
+            host: minio-console
+            port:
+              number: 9090
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: minio-api
+  namespace: minio
+spec:
+  hosts:
+    - s3.gwg313.xyz
+  gateways:
+    - minio-gateway
+  http:
+    - match:
+        - uri:
+            prefix: /
+      route:
+        - destination:
+            host: minio
+            port:
+              number: 9000