fix: minio TLS

Author: dervoeti

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 default_language_version:
   node: system
 
-exclude: '^stacks/_templates/minio-tls/rendered-chart\.yaml$'
+exclude: '^stacks/_templates/minio(-distributed)?-tls/rendered-chart\.yaml$'
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks

demos/data-lakehouse-iceberg-trino-spark/load-test-data.yaml

@@ -9,14 +9,17 @@ spec:
       containers:
         - name: load-test-data
           image: "bitnami/minio:2024-debian-12"
+          env:
+          - name: MC_INSECURE
+            value: "true"
           # Please try to order the load jobs from small to large datasets
           command:
             - bash
             - -xeuo
             - pipefail
             - -c
             - |
-              mc alias set minio https://minio:9000/ $(cat /minio-s3-credentials/accessKey) $(cat /minio-s3-credentials/secretKey)
+              mc alias set minio https://minio.default.svc.cluster.local:9000/ $(cat /minio-s3-credentials/accessKey) $(cat /minio-s3-credentials/secretKey)
               cd /tmp
 
               curl -sO https://repo.stackable.tech/repository/misc/datasets/open-postcode-geo/open-postcode-geo.csv

stacks/_templates/minio-distributed-tls/README.md

@@ -0,0 +1,16 @@
+# MinIO with TLS from secret-operator
+
+MinIO has a severe limitation whereby the TLS certificates must be named `public.crt`
+and `private.key`. This goes against Kubernetes naming of `tls.crt` and `tls.key`.
+
+The upstream minio chart is also too limited:
+
+- No way to add initContainers (to rename cert files in a shared volume).
+- No way to edit the container command (to rename cert files before starting minio).
+
+Therefore, we will render the upstream chart here, and then apply the necessary
+customizations on top.
+
+```yaml
+helm template minio minio/minio -f values.yaml > rendered-chart.yaml
+```