feat(storage): migrate SeaweedFS S3 credentials to VSO; mount s3.json from Secret

Previously s3.json was embedded in the seaweedfs-filer-config ConfigMap
with hardcoded minioadmin credentials, and the config volume was mounted
at /etc/seaweedfs/ (overwriting filer.toml with its own directory mount).

- Remove s3.json from ConfigMap; fix the config volume to mount only
  filer.toml via subPath so both files coexist under /etc/seaweedfs/.
- Add vault-secrets.yaml with VaultStaticSecrets that VSO syncs from
  OpenBao secret/seaweedfs: seaweedfs-s3-credentials (S3_ACCESS_KEY /
  S3_SECRET_KEY) and seaweedfs-s3-json (s3.json as a JSON template).
- Mount seaweedfs-s3-json Secret at /etc/seaweedfs/s3.json via subPath.

base/storage/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - seaweedfs-master.yaml
   - seaweedfs-volume.yaml
   - seaweedfs-filer.yaml
+  - vault-secrets.yaml

base/storage/seaweedfs-config.yaml

@@ -16,22 +16,6 @@ data:
     enabled        = true
     port           = 8333
 
-  s3.json: |
-    {
-      "identities": [
-        {
-          "name": "minioadmin",
-          "credentials": [
-            {
-              "accessKey": "minioadmin",
-              "secretKey": "minioadmin"
-            }
-          ],
-          "actions": ["Admin", "Read", "Write", "List", "Tagging"]
-        }
-      ]
-    }
-
   master.toml: |
     [master.maintenance]
     sleep_minutes          = 17

base/storage/seaweedfs-filer.yaml

@@ -38,7 +38,12 @@ spec:
                 name: seaweedfs-s3-credentials
           volumeMounts:
             - name: config
-              mountPath: /etc/seaweedfs
+              mountPath: /etc/seaweedfs/filer.toml
+              subPath: filer.toml
+              readOnly: true
+            - name: s3-json-secret
+              mountPath: /etc/seaweedfs/s3.json
+              subPath: s3.json
               readOnly: true
             - name: filer-data
               mountPath: /data/filer
@@ -52,6 +57,9 @@ spec:
         - name: config
           configMap:
             name: seaweedfs-filer-config
+        - name: s3-json-secret
+          secret:
+            secretName: seaweedfs-s3-json
         - name: filer-data
           emptyDir: {}
 ---

base/storage/vault-secrets.yaml

@@ -0,0 +1,56 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vso-auth
+  namespace: storage
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: vso
+    serviceAccount: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: seaweedfs-s3-credentials
+  namespace: storage
+spec:
+  vaultAuthRef: vso-auth
+  mount: secret
+  type: kv-v2
+  path: seaweedfs
+  refreshAfter: 30s
+  destination:
+    name: seaweedfs-s3-credentials
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      templates:
+        S3_ACCESS_KEY:
+          text: "{{ index .Secrets \"access-key\" }}"
+        S3_SECRET_KEY:
+          text: "{{ index .Secrets \"secret-key\" }}"
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: seaweedfs-s3-json
+  namespace: storage
+spec:
+  vaultAuthRef: vso-auth
+  mount: secret
+  type: kv-v2
+  path: seaweedfs
+  refreshAfter: 30s
+  destination:
+    name: seaweedfs-s3-json
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      templates:
+        "s3.json":
+          text: '{"identities":[{"name":"seaweed","credentials":[{"accessKey":"{{ index .Secrets "access-key" }}","secretKey":"{{ index .Secrets "secret-key" }}"}],"actions":["Admin","Read","Write","List","Tagging"]}]}'