Migrate minio to the platform namespace

installations/applications/helmfile.yaml

@@ -85,14 +85,15 @@ releases:
     inherit:
       - template: default-env-values
       - template: ext-tcp-routes
-  #- name: vaultwardentest
-  #  chart: allangers-charts/vaultwarden
-  #  version: 2.1.0
-  #  namespace: applications
-  #  inherit:
-  #    - template: default-env-values
-  #    - template: default-env-secrets
   - name: shadowsocks-libev
+    #- name: vaultwardentest
+    #  chart: allangers-charts/vaultwarden
+    #  version: 2.1.0
+    #  namespace: applications
+    #  inherit:
+    #    - template: default-env-values
+    #    - template: default-env-secrets
+
     chart: allangers-charts/shadowsocks-libev
     namespace: applications
     version: 0.3.1

installations/platform/helmfile.yaml

@@ -10,16 +10,12 @@ repositories:
     url: https://zotregistry.dev/helm-charts/
   - name: bedag
     url: https://bedag.github.io/helm-charts/
-  - name: minio-standalone
-    url: https://charts.min.io/
-  - name: minio
-    url: https://operator.min.io/
-  - name: fluxcd-community
-    url: https://fluxcd-community.github.io/helm-charts
   - name: crossplane-stable
     url: https://charts.crossplane.io/stable
   - name: goauthentik
     url: https://charts.goauthentik.io/
+  - name: minio-standalone
+    url: https://charts.min.io/
 releases:
   - name: argocd
     chart: argo/argo-cd
@@ -30,12 +26,6 @@ releases:
     inherit:
       - template: default-env-values
       - template: default-env-secrets
-  - name: flux
-    chart: fluxcd-community/flux2
-    namespace: platform
-    condition: workload.enabled
-    version: 2.13.0
-    installed: false
   - name: db-operator
     namespace: platform
     chart: db-operator/db-operator
@@ -69,32 +59,12 @@ releases:
     inherit:
       - template: default-env-values
       - template: default-env-secrets
-  - name: minio-operator
-    chart: minio/operator
-    version: 6.0.3
-    namespace: platform
-    installed: false
-    condition: workload.enabled
-    inherit:
-      - template: default-env-values
-  - name: minio-tenant
-    chart: minio/tenant
-    version: 6.0.3
-    namespace: platform
-    installed: false
-    condition: workload.enabled
-    needs:
-      - platform/minio-operator
-    inherit:
-      - template: default-env-values
   - name: crossplane
-    #     - template: default-env-secrets
-
     chart: crossplane-stable/crossplane
+    installed: false
     version: 1.17.0
     namespace: platform
     condition: workload.enabled
-    installed: true
     inherit:
       - template: default-env-values
   - name: authentik
@@ -106,3 +76,10 @@ releases:
       - template: default-env-values
       - template: default-env-secrets
       - template: ext-database
+  - name: minio
+    chart: minio-standalone/minio
+    version: 5.2.0
+    namespace: platform
+    inherit:
+      - template: default-env-values
+      - template: default-env-secrets

manifests/network-policy.yaml

@@ -0,0 +1,32 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-deny-all
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-internet-only
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+      ports:
+        - protocol: TCP
+          port: 53
+        - protocol: UDP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 192.168.0.0/16
+              - 172.16.0.0/20

values/badhouseplants/values.minio.yaml

@@ -1,4 +1,3 @@
----
 # ------------------------------------------
 # -- Istio extenstion. Just because I'm
 # --  not using ingress nginx
@@ -18,7 +17,6 @@ istio:
       hostname: s3.badhouseplants.net
       service: minio
       port: 9000
-
 ingress:
   enabled: true
   ingressClassName: ~
@@ -53,7 +51,6 @@ consoleIngress:
     - secretName: minio-tls-secret
       hosts:
         - minio.badhouseplants.net
-
 rootUser: 'overlord'
 replicas: 1
 mode: standalone
@@ -66,7 +63,7 @@ tls:
   privateKey: private.key
 persistence:
   enabled: true
-  accessMode: ReadWriteOnce
+  accessMode: ReadWriteMany
   size: 10Gi
 service:
   type: ClusterIP