Phase 2c: k8s Deployment + CI

phase-minio-mobile-2c-k8s-deploy Phase

phase

Project

Goal: Dockerize the MinIO API service, set up Woodpecker CI, push to Harbor, and deploy to k3s with Tailscale funnel.

Owner: Dev agent

Repo: forgejo_admin/minio-api + forgejo_admin/deployments

Depends on: phase-minio-mobile-2b-keycloak-auth (auth must be wired before deploy)

Scope

Dockerfile (Python 3.12 slim, uvicorn)
Woodpecker CI pipeline: lint, test, build image, push to Harbor
Harbor project setup for minio-api image
Kustomize overlay in pal-e-deployments (base + prod)
k8s Deployment, Service, NetworkPolicy
Tailscale funnel ingress for API access
Keycloak credentials + MinIO credentials as k8s secrets
Service onboarding via pal-e-services Terraform (if applicable)

Deliverables

Filled after completion

phase-minio-mobile-2-api-auth — parent phase
phase-minio-mobile-2b-keycloak-auth — prerequisite
service-onboarding-sop — deployment SOP