feat(manifests): add a MiniStack component for the quick-start artifact repository

[Nahuel990]

See the pull request guide for details on each item.

• Ran make pre-commit -B
• Signed-off commits with Conventional Commit messages
• PR title is a conventional commit message (it becomes the release notes entry)
• Unit or e2e tests cover the change
• For features: an associated issue and a feature description file (make feature-new)
• Opened as draft; will mark "Ready for review" once builds are green

Refs #17030

Motivation

The quick-start artifact repository runs MinIO pinned to quay.io/minio/minio:RELEASE.2022-11-17T23-20-09Z. MinIO has since stopped publishing community edition images and the minio/minio repository is archived, last pushed 2026-04-24. The pinned digest still resolves, so nothing is broken today, but there is no upstream path for a future CVE.

Rather than change the default, this adds an opt-in alternative so the quick-start has a maintained option. MinIO stays exactly as it is.

Modifications

New component manifests/components/ministack, following the shape of components/mysql:

• ministack-deployment.yaml and ministack-service.yaml serve S3 on port 4566, with /_ministack/health readiness and liveness probes, and a postStart hook that creates my-bucket through the awslocal wrapper bundled in the image. The hook retries because the port binds before startup finishes, and always exits 0 so a slow start cannot kill the container.
• Two $patch: delete overlays drop the MinIO Deployment and Service.
• Overlay patches repoint artifact-repositories-configmap.yaml and overlays/workflow-controller-configmap.yaml from minio:9000 to ministack:4566.
• The my-minio-cred secret is left alone, since those credentials work unchanged.

New variant manifests/quick-start/ministack composes ../base with the component. The image is pinned by digest, matching how MinIO is pinned.

.features/pending/ministack-quick-start-component.md describes the change for the release notes. go run ./hack/featuregen validate reports all feature documents valid.

No generated manifests are included: make manifests should be run by a maintainer if this variant is wanted in dist.

Verification

kubectl kustomize manifests/quick-start/ministack builds, and in the output the MinIO Deployment and Service are gone, no minio:9000 reference remains, and all three artifact repository endpoints point at ministack:4566.

Against the pinned image directly:

• the postStart command creates my-bucket and exits 0
• PutObject, GetObject and ListObjectsV2 succeed with the my-minio-cred credentials using path style addressing
• /_ministack/health returns 200

Deployed for real on kind v0.30.0, kubectl apply --server-side of the built variant into namespace argo:

• ministack, workflow-controller, argo-server and httpbin all reach ready, and no MinIO Deployment or Service is created
• the postStart hook created my-bucket in the cluster
• a workflow with an output artifact reached Succeeded, and Argo recorded the keys artifact-check-.../hello.tgz and artifact-check-.../main.log
• both objects are present in MiniStack, 136 and 5 bytes, and round-trip intact: the artifact tarball contains the file the step wrote, and the archived log contains the step output

Regression check on the existing variants: minimal, mysql, postgres and telemetry all regenerate byte-identical to the committed manifests/quick-start-*.yaml, so this change adds files without perturbing any existing output.

I have not run make pre-commit -B, which needs the full codegen toolchain, so that box stays unticked.

Documentation

None yet. If maintainers want this variant documented, the natural place is the artifact repository page, and I am happy to add it in this PR.

AI

Claude (Anthropic) was used to draft the manifests, the commit message and this description. Every claim above was verified by me against the built output and a running container, as described in Verification.

[github-actions]

✅ PR readiness: all clear

All contributor-fixable checks are passing. A maintainer will take it from here — thanks!

---

_{🤖 Automated PR-readiness helper — it re-checks each time CI finishes. Unit/E2E test results are not covered here. Questions? See the contributing guide or ask a maintainer.}