You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Organize Examples to use a consitent name
Signed-off-by: Daniel Valdivia <[email protected]>
* react lint
Signed-off-by: Daniel Valdivia <[email protected]>
---------
Signed-off-by: Daniel Valdivia <[email protected]>
Copy file name to clipboardExpand all lines: docs/cert-manager.md
+10-5
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,23 @@
1
1
# MinIO tenant with cert-manager [](https://slack.min.io)
2
2
3
-
This document explains how to deploy a MinIO tenant using certificates generated by [cert-manager](https://cert-manager.io/).
3
+
This document explains how to deploy a MinIO tenant using certificates generated
4
+
by [cert-manager](https://cert-manager.io/).
4
5
5
6
## Getting Started
6
7
7
8
### Prerequisites
8
9
9
-
- Kubernetes version `+v1.19`. While cert-manager supports [earlier K8s versions](https://cert-manager.io/docs/installation/supported-releases/), the MinIO Operator requires 1.19 or later.
10
+
- Kubernetes version `+v1.19`. While cert-manager
11
+
supports [earlier K8s versions](https://cert-manager.io/docs/installation/supported-releases/), the MinIO Operator
12
+
requires 1.19 or later.
10
13
- MinIO Operator installed
11
14
-`kubectl` access to your `k8s` cluster
12
15
-[cert-manager](https://cert-manager.io/docs/installation/) 1.7.X or later installed
This document explains how to control the names used for host discovery. This allows us to discover hosts using external name services, which is useful for serving with trusted certificates.
3
+
This document explains how to control the names used for host discovery. This allows us to discover hosts using external
4
+
name services, which is useful for serving with trusted certificates.
4
5
5
6
## Getting Started
6
7
7
-
If MinIO Tenant is named `tenant1`, then the four servers will be called `tenant1-pool-0-0`, `tenant1-pool-0-1`, `tenant1-pool-0-2`, and `tenant1-pool-0-3`. If all of your hosts are available at the domain `example.com` then you can use the `--hosts-template` flag in [MinIO Operator Deployment yaml](https://github.com/minio/operator/blob/master/minio-operator.yaml) to update discovery. This will generate the discovery string `tenant1-pool-0-{0...3}.example.com`.
8
+
If MinIO Tenant is named `tenant1`, then the four servers will be
9
+
called `myminio-pool-0-0`, `myminio-pool-0-1`, `myminio-pool-0-2`, and `myminio-pool-0-3`. If all of your hosts are
10
+
available at the domain `example.com` then you can use the `--hosts-template` flag
11
+
in [MinIO Operator Deployment yaml](https://github.com/minio/operator/blob/master/minio-operator.yaml) to update
12
+
discovery. This will generate the discovery string `myminio-pool-0-{0...3}.example.com`.
Copy file name to clipboardExpand all lines: docs/examples.md
+44-23
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,17 @@
1
1
# Tenant deployment examples with kustomize
2
2
3
-
This document explains various yaml files listed in the [examples directory](https://github.com/minio/operator/tree/master/examples/kustomization) used to deploy a Tenant using MinIO Operator.
3
+
This document explains various yaml files listed in
4
+
the [examples directory](https://github.com/minio/operator/tree/master/examples/kustomization) used to deploy a Tenant
MinIO Operator can automatically generate TLS secrets and mount these secrets to the MinIO, Console, and/or KES pods (enabled by default). To disable this, set the `requestAutoCert` field to `false`.
13
+
MinIO Operator can automatically generate TLS secrets and mount these secrets to the MinIO, Console, and/or KES pods (
14
+
enabled by default). To disable this, set the `requestAutoCert` field to `false`.
12
15
13
16
You can deploy the pre-configured example by running the following command:
14
17
@@ -35,14 +38,16 @@ This example will deploy a MinIO tenant with Server Side Encryption using KES an
35
38
- Enable role auth: `vault auth enable approle`
36
39
- Enable secrets k/v: `vault secrets enable kv`
37
40
- Create a new `KES` policy: `vault policy write kes-policy examples/vault/kes-policy.hcl`
38
-
- Create a new `KES` role based on the `KES` policy: `vault write auth/approle/role/kes-role token_num_uses=0 secret_id_num_uses=0 period=5m policies=kes-policy`
`MinIO` will use `*.minio-tenant.svc.cluster.local`, `*.storage.minio-tenant.svc.cluster.local` and `*.storage-hl.minio-tenant.svc.cluster.local` certificates for
85
+
86
+
`MinIO` will use `*.minio-tenant.svc.cluster.local`, `*.myminio.minio-tenant.svc.cluster.local`
87
+
and `*.myminio-hl.minio-tenant.svc.cluster.local` certificates for
80
88
inter-node communication.
81
89
82
90
Create `kubernetes secrets` based on the previous certificates
You can include all the certificates that you want in your Tenant and `MinIO` will serve them to its client via [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication)
115
+
116
+
You can include all the certificates that you want in your Tenant and `MinIO` will serve them to its client
117
+
via [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication)
108
118
109
119
## MinIO Tenant with TLS via customer provided certificates and Encryption enabled via Vault KMS
110
120
111
-
This example will deploy a minio tenant using mTLS certificates (authentication between `MinIO` and `KES`) provided by the user, the data will be encrypted at rest
121
+
This example will deploy a minio tenant using mTLS certificates (authentication between `MinIO` and `KES`) provided by
122
+
the user, the data will be encrypted at rest
112
123
113
124
### Prerequisites
114
125
115
126
- Configure `Vault` the same way as in the first example
116
127
- Set the `app-role-id`, the `app-role-secret-id` and `key-prefix` in your KES configuration `YAML` file
117
-
- Assuming your Tenant name is `storage-kms-encrypted` and namespace is `tenant-kms-encrypted` create all the certificates and secrets as in the previous step
118
-
- Generate new `KES` identity keypair (https://github.com/minio/kes), this is needed it for the authentication, `mTLS` between `MinIO` and `KES`:
128
+
- Assuming your Tenant name is `myminio` and namespace is `tenant-kms-encrypted` create all the certificates and
129
+
secrets as in the previous step
130
+
- Generate new `KES` identity keypair (https://github.com/minio/kes), this is needed it for the authentication, `mTLS`
131
+
between `MinIO` and `KES`:
119
132
120
133
```sh
121
134
kes tool identity new --key="./app.key" --cert="app.cert" app
122
135
```
123
136
124
-
- Using the generated `app.key` and `app.cert` create a new kubernetes secret: `kubectl create secret tls minio-kes-mtls --key="app.key" --cert="app.cert"` -n tenant-kms-encrypted
125
-
and provide that secret in the `externalClientCertSecret` field of your tenant `YAML` overlay (if the field doesn't exist add it)
137
+
- Using the generated `app.key` and `app.cert` create a new kubernetes
and provide that secret in the `externalClientCertSecret` field of your tenant `YAML` overlay (if the field doesn't
140
+
exist add it)
126
141
127
142
```$xslt
128
143
spec:
@@ -133,7 +148,8 @@ This example will deploy a minio tenant using mTLS certificates (authentication
133
148
```
134
149
135
150
- Calculate the `app.cert` identity using `KES`: `kes tool identity of app.cert`, copy the resulting hash and open your
136
-
KES configuration `YAML` (`kes-configuration-secret.yaml`) file and replace `${MINIO_KES_IDENTITY}` for the `bda5d8b6531d2f3bcd64e5ec73841bcb23ecb57b19c5f814e491ea2b2088995c` string, you can
151
+
KES configuration `YAML` (`kes-configuration-secret.yaml`) file and replace `${MINIO_KES_IDENTITY}` for
152
+
the `bda5d8b6531d2f3bcd64e5ec73841bcb23ecb57b19c5f814e491ea2b2088995c` string, you can
137
153
add additional identities using this array, ie:
138
154
139
155
```$xslt
@@ -146,7 +162,7 @@ This example will deploy a minio tenant using mTLS certificates (authentication
## MinIO Tenant with Services expose through NodePort
159
175
160
176
MinIO Operator can automatically generate `LoadBalancer` and `ClusterIP` type services when deploying tenants, however
161
-
there is one more way to expose your services in case you don't want to deal with `load balancers` or `ingress` configurations and
162
-
that is `NodePort`. NodePort type services will be accessible by opening a port on each Kubernetes cluster node, read more about [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport).
177
+
there is one more way to expose your services in case you don't want to deal with `load balancers` or `ingress`
178
+
configurations and
179
+
that is `NodePort`. NodePort type services will be accessible by opening a port on each Kubernetes cluster node, read
180
+
more about [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport).
For additional examples on how to deploy a tenant with [LDAP](https://min.io/docs/minio/kubernetes/upstream/operations/external-iam/configure-ad-ldap-external-identity-management.html) or [OIDC](https://min.io/docs/minio/kubernetes/upstream/operations/external-iam/configure-openid-external-identity-management.html) you can look at the [examples directory](https://github.com/minio/operator/tree/master/examples/kustomization)
188
+
For additional examples on how to deploy a tenant
189
+
with [LDAP](https://min.io/docs/minio/kubernetes/upstream/operations/external-iam/configure-ad-ldap-external-identity-management.html)
190
+
or [OIDC](https://min.io/docs/minio/kubernetes/upstream/operations/external-iam/configure-openid-external-identity-management.html)
191
+
you can look at the [examples directory](https://github.com/minio/operator/tree/master/examples/kustomization)
0 commit comments