test: replace MinIO with RustFS as the S3-compatible object store

.wordlist.txt

@@ -48,6 +48,7 @@ RTO
 RecoveryWindow
 ResourceRequirements
 RetentionPolicy
+RustFS
 SAS
 SDK
 SFO

hack/examples/cluster-example-legacy.yaml

@@ -8,16 +8,16 @@ spec:
   backup:
     barmanObjectStore:
       endpointCA:
-        name: minio-server-tls
+        name: object-store-tls
         key: tls.crt
       destinationPath: s3://backups/
-      endpointURL: https://minio:9000
+      endpointURL: https://object-store:9000
       s3Credentials:
         accessKeyId:
-          name: minio
+          name: object-store
           key: ACCESS_KEY_ID
         secretAccessKey:
-          name: minio
+          name: object-store
           key: ACCESS_SECRET_KEY
       wal:
         compression: gzip

hack/examples/cluster-example.yaml

@@ -9,7 +9,7 @@ spec:
   - name: barman-cloud.cloudnative-pg.io
     isWALArchiver: true
     parameters:
-      barmanObjectName: minio-store
+      barmanObjectName: object-store
 
   storage:
     size: 1Gi

hack/examples/cluster-replica-log-shipping.yaml

@@ -15,7 +15,7 @@ spec:
     plugin:
       name: barman-cloud.cloudnative-pg.io
       parameters:
-        barmanObjectName: minio-store
+        barmanObjectName: object-store
         serverName: cluster-example
   storage:
     size: 1Gi

hack/examples/cluster-replica-streaming.yaml

@@ -29,7 +29,7 @@ spec:
     plugin:
       name: barman-cloud.cloudnative-pg.io
       parameters:
-        barmanObjectName: minio-store
+        barmanObjectName: object-store
         serverName: cluster-example
   storage:
     size: 1Gi

hack/examples/cluster-restore-archive.yaml

@@ -14,14 +14,14 @@ spec:
   - name: barman-cloud.cloudnative-pg.io
     isWALArchiver: true
     parameters:
-      barmanObjectName: minio-store-bis
+      barmanObjectName: object-store-bis
 
   externalClusters:
   - name: source
     plugin:
       name: barman-cloud.cloudnative-pg.io
       parameters:
-        barmanObjectName: minio-store
+        barmanObjectName: object-store
         serverName: cluster-example
 
   storage:

hack/examples/cluster-restore.yaml

@@ -15,7 +15,7 @@ spec:
     plugin:
       name: barman-cloud.cloudnative-pg.io
       parameters:
-        barmanObjectName: minio-store
+        barmanObjectName: object-store
         serverName: cluster-example
 
   storage:

hack/examples/minio-store.yaml → hack/examples/object-store.yaml

@@ -1,7 +1,7 @@
 apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
-  name: minio-store
+  name: object-store
 spec:
   retentionPolicy: "1m"
   instanceSidecarConfiguration:
@@ -16,16 +16,16 @@ spec:
         cpu: "500m"
   configuration:
     endpointCA:
-      name: minio-server-tls
+      name: object-store-tls
       key: tls.crt
     destinationPath: s3://backups/
-    endpointURL: https://minio:9000
+    endpointURL: https://object-store:9000
     s3Credentials:
       accessKeyId:
-        name: minio
+        name: object-store
         key: ACCESS_KEY_ID
       secretAccessKey:
-        name: minio
+        name: object-store
         key: ACCESS_SECRET_KEY
     wal:
       compression: gzip

hack/object-store/kustomization.yaml

@@ -0,0 +1,8 @@
+resources:
+- object-store-deployment.yaml
+- object-store-pvc.yaml
+- object-store-secret.yaml
+- object-store-service.yaml
+- object-store-certificate.yaml
+- selfsigned-issuer.yaml
+- s3-client.yaml

hack/minio/minio-certificate.yaml → hack/object-store/object-store-certificate.yaml

@@ -1,12 +1,14 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: minio-server
+  name: object-store-server
 spec:
-  secretName: minio-server-tls
-  commonName: minio
+  secretName: object-store-tls
+  commonName: object-store
   dnsNames:
-    - minio
+    - object-store
+    - object-store.default
+    - object-store.default.svc
 
   duration: 2160h # 90d
   renewBefore: 360h # 15d

hack/object-store/object-store-deployment.yaml

@@ -0,0 +1,124 @@
+# RustFS, an S3-compatible object store, served over TLS with a certificate
+# issued by cert-manager (see object-store-certificate.yaml).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: object-store
+  labels:
+    app: object-store
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: object-store
+  template:
+    metadata:
+      labels:
+        app: object-store
+    spec:
+      # RustFS runs as a non-root user but the PVC is root-owned: the init
+      # container creates writable subdirectories for data and logs.
+      initContainers:
+      - name: init-permissions
+        # renovate: datasource=docker depName=busybox versioning=docker
+        # Version: 1.38.0
+        image: docker.io/library/busybox@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
+        command:
+        - sh
+        - -c
+        - mkdir -p /data/rustfs /logs/rustfs && chmod 0777 /data/rustfs /logs/rustfs
+        volumeMounts:
+        - mountPath: /data
+          name: data
+        - mountPath: /logs
+          name: logs
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
+      containers:
+      - name: object-store
+        # renovate: datasource=docker depName=rustfs/rustfs versioning=docker
+        # Version: 1.0.0-glibc
+        image: docker.io/rustfs/rustfs@sha256:bffcab0c9d647aab0055d1c69d340b202d0909966b385932d4ead1aeb7602858
+        command:
+        - /usr/bin/rustfs
+        ports:
+        - containerPort: 9000
+          name: api
+        env:
+        - name: RUSTFS_ADDRESS
+          value: ":9000"
+        - name: RUSTFS_VOLUMES
+          value: /data/rustfs
+        - name: RUSTFS_REGION
+          value: us-east-1
+        - name: RUSTFS_CONSOLE_ENABLE
+          value: "false"
+        - name: RUSTFS_OBS_LOG_DIRECTORY
+          value: /logs/rustfs
+        # RustFS enables TLS when it finds rustfs_cert.pem and rustfs_key.pem
+        # in this directory.
+        - name: RUSTFS_TLS_PATH
+          value: /certs
+        - name: RUSTFS_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: object-store
+              key: ACCESS_KEY_ID
+        - name: RUSTFS_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: object-store
+              key: ACCESS_SECRET_KEY
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 9000
+            scheme: HTTPS
+          initialDelaySeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 9000
+            scheme: HTTPS
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        volumeMounts:
+        - mountPath: /data
+          name: data
+        - mountPath: /logs
+          name: logs
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: object-store
+      - name: logs
+        emptyDir: {}
+      - name: certs
+        secret:
+          secretName: object-store-tls
+          items:
+          - key: tls.crt
+            path: rustfs_cert.pem
+          - key: tls.key
+            path: rustfs_key.pem

hack/minio/minio-pvc.yaml → hack/object-store/object-store-pvc.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: minio
+  name: object-store
 spec:
   accessModes:
     - ReadWriteOnce

hack/minio/minio-secret.yaml → hack/object-store/object-store-secret.yaml

@@ -4,4 +4,4 @@ data:
   ACCESS_SECRET_KEY: b25nZWlxdWVpdG9oTDBxdWVlTG9oa2l1cjJxdWFpbmc=
 kind: Secret
 metadata:
-  name: minio
+  name: object-store

hack/minio/minio-service.yaml → hack/object-store/object-store-service.yaml

@@ -1,16 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: minio
+  name: object-store
 spec:
   selector:
-    app: minio
+    app: object-store
   ports:
     - protocol: TCP
       port: 9000
       targetPort: 9000
       name: api
-    - protocol: TCP
-      port: 36261
-      targetPort: 36261
-      name: webui