# ── MinIO(单副本 on Longhorn=盘冗余在下层;集群 EC 形态后续档)────────────────
apiVersion: v1
kind: Secret
metadata:
  name: sema-minio
  namespace: {{ .Release.Namespace }}
stringData:
  rootUser: {{ .Values.minio.rootUser | quote }}
  rootPassword: {{ required "minio.rootPassword is required" .Values.minio.rootPassword | quote }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sema-minio-data
  namespace: {{ .Release.Namespace }}
spec:
  accessModes: [ReadWriteOnce]
{{- if .Values.minio.storageClass }}
  storageClassName: {{ .Values.minio.storageClass }}
{{- end }}
  resources:
    requests:
      storage: {{ .Values.minio.storageSize }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sema-minio
  namespace: {{ .Release.Namespace }}
spec:
  replicas: 1
  selector:
    matchLabels: { app: sema-minio }
  template:
    metadata:
      labels: { app: sema-minio }
    spec:
      containers:
        - name: minio
          image: {{ .Values.minio.image }}
          args: ["server", "/data", "--console-address", ":9001"]
          env:
            - name: MINIO_ROOT_USER
              valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } }
            - name: MINIO_ROOT_PASSWORD
              valueFrom: { secretKeyRef: { name: sema-minio, key: rootPassword } }
          ports: [{ containerPort: 9000 }, { containerPort: 9001 }]
          volumeMounts: [{ name: data, mountPath: /data }]
      volumes:
        - name: data
          persistentVolumeClaim: { claimName: sema-minio-data }
---
apiVersion: v1
kind: Service
metadata:
  name: sema-minio
  namespace: {{ .Release.Namespace }}
spec:
  selector: { app: sema-minio }
  ports:
    - { name: s3, port: 9000 }
    - { name: console, port: 9001 }