Documentation

Documentation

MinIO Console

The MinIO Console is a rich graphical user interface that provides similar functionality to the mc command line tool.

MinIO Console Landing Page provides a view of Buckets on the deployment

You can use the MinIO Console for administration tasks like Identity and Access Management, Metrics and Log Monitoring, or Server Configuration.

The MinIO Console is embedded as part of the MinIO Server. You can also deploy a standalone MinIO Console using the instructions in the github repository.

Logging into the MinIO Console depends on how you configured identity management for the deployment.

  • When using the built-in MinIO identity management solution, the sign-in screen displays a standard login screen. Enter your Username and Password to log in to the MinIO Console.

  • If loggin in with a third party application and MinIO’s Security Token Service (STS), select Use STS and enter the Username, Secret, and Token.

  • If the deployment uses a single OpenID or Active Directory/LDAP identity provider solution, select the provider’s button to proceed to the login screen.

  • If the deployment has multiple OpenID and/or Active Directory/LDAP identify management providers configured, the MinIO Console’s sign-in screen provides a dropdown list of providers. Select the provider you wish to use to log in to the MinIO Console, then enter the credentials.

Try out the Console using MinIO’s Play testing environment

You can explore the Console using https://play.min.io:9443. Log in with the following credentials:

  • Username: Q3AM3UQ867SPQQA43P2F

  • Password: zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG

The Play Console connects to the MinIO Play deployment at https://play.min.io. You can also access this deployment using mc and using the play alias.

This page documents the high level configuration settings and features of the MinIO Console.

Configuration

The MinIO Console inherits the majority of its configuration settings from the MinIO Server. The following environment variables enable specific behavior in the MinIO Console:

Environment Variable

Description

MINIO_PROMETHEUS_URL

The URL for a Prometheus server configured to scrape metrics from the MinIO deployment. The MinIO Console uses this server for populating the metrics dashboard.

See Monitoring and Alerting using Prometheus for a tutorial on configuring Prometheus to collect metrics from MinIO.

MINIO_SERVER_URL

The URL hostname the MinIO Console uses for connecting to the MinIO Server. The hostname must be resolveable and reachable for the Console to function correctly.

The MinIO Console connects to the MinIO Server using an IP address by default. For example, when the MinIO Server starts up, the server logs include a line API: https://<IP ADDRESS 1> https://<IP ADDRESS 2>. The MinIO Console defaults to connecting using <IP ADDRESS 1>.

The MinIO Console may require setting this variable in the following scenarios:

  • The MinIO server TLS certificates do not include the local IP address as a Subject Alternative Name (SAN). Specify a hostname contained in the TLS certificate to allow the MinIO Console to validate the TLS connection.

  • The MinIO server’s local IP address is not reachable by the MinIO Console. Specify a resolveable hostname for the MinIO Server.

  • A load balancer or reverse proxy controls traffic to the MinIO server, such that the MinIO Console cannot reach the server without going through the load balancer/proxy. Specify the load balancer/proxy URL for the MinIO server.

MINIO_BROWSER_REDIRECT_URL

The externally resolvable hostname for the MinIO Console used by the configured external identity manager for returning the authentication response.

This variable is typically necessary when using a reverse proxy, load balancer, or similar system to expose the MinIO Console to the public internet. Specify an externally reachable hostname that resolves to the MinIO Console.

Static vs Dynamic Port Assignment

MinIO by default selects a random port for the MinIO Console on each server startup. Browser clients accessing the MinIO Server are automatically redirected to the MinIO Console on its dynamically selected port. This behavior emulates the legacy web browser behavior while reducing the the risk of a port collision on systems which were running MinIO before the embedded Console update.

You can select an explicit static port by passing the minio server --console-address commandline option when starting each MinIO Server in the deployment.

For example, the following command starts a distributed MinIO deployment using a static port assignment of 9001 for the MinIO Console. This deployment would respond to S3 API operations on the default MinIO server port :9000 and browser access on the MinIO Console port :9001.

minio server https://minio-{1...4}.example.net/mnt/drive-{1...4} \
      --console-address ":9001"

Deployments behind network routing components which require static ports for routing rules may require setting a static MinIO Console port. For example, load balancers, reverse proxies, or Kubernetes ingress may by default block or exhibit unexpected behavior with the the dynamic redirection behavior.

Buckets

MinIO Console Object Browser

The Console Object Browser section displays all buckets and objects to which the authenticated user has access.

Use the Search bar to search for specific buckets or objects. Select the row for the bucket or object to browse.

Select Create Bucket to create a new bucket on the deployment. MinIO validates bucket names. To see the rules for bucket names, select View Bucket Naming Rules.

While creating a bucket, you can enable versioning, object locking, bucket size (quota) limits, and retention rules (which require versioning).

MinIO recommends no more than 500,000 buckets per deployment.

Each bucket has Manage and Browse buttons.

  • Select Manage to open the management interface for the bucket:

    Some management features may not be available if the authenticated user does not have the required administrative permissions.

    The Summary view displays a summary of the bucket’s configuration.

    The Events view supports configuring notification events using a configured notification target.

    The Replication view supports creating and managing Server Side Bucket Replication Rules.

    The Lifecycle view supports creating and managing Object Lifecycle Management Rules for the bucket.

    The Access Audit view displays all policies and users with access to that bucket.

    The Access Rules view supports creating and managing anonymous bucket policies to attach to the bucket or bucket prefix. Anonymous rules allow clients to access the bucket or prefix without explicitly authenticating with user credentials.

  • Select Browse to view the contents of the bucket. You can view and download individual objects, upload new objects, or use the Rewind function to view only those versions of an object which existed at the selected timestamp.

Access Keys

MinIO Console Access Keys

The Access Keys section displays all Access Keys associated to the authenticated user.

Access Keys support providing applications authentication credentials which inherit permissions from the “parent” user.

For deployments using an external identity manager such as Active Directory or an OIDC-compatible provider, access keys provide a way for users to create long-lived credentials.

  • You can select the access key row to view its custom policy, if one exists.

    You can create or modify the policy from this screen. Access key policies cannot exceed the permissions granted to the parent user.

  • You can create a new access key by selecting Create access key.

    The Console auto-generates an access key and password. You can select the eye icon on the password field to reveal the value. You can override these values as needed.

    You can set a custom policy for the access key that further restricts the permissions granted to users authenticating with that key. Select Restrict beyond user policy to open the policy editor and modify as necessary.

    Ensure you have saved the access key password to a secure location before selecting Create to create the access key. You cannot retrieve or reset the password value after creating the access key.

    To rotate credentials for an application, create a new access key and delete the old one once the application updates to using the new credentials.

Identity

The Identity section provides a management interface for MinIO-Managed users.

The section contains the following subsections. Some subsections may not be visible if the authenticated user does not have the required administrative permissions.

MinIO Console Manage Users

The Users section displays all MinIO-managed users on the deployment.

This section is not visible for deployments using an external identity manager such as Active Directory or an OIDC-compatible provider.

  • Select Create User to create a new MinIO-managed user.

    You can assign groups and policies to the user during creation.

  • Select a user’s row to view details for that user.

    You can view and modify the user’s assigned groups and policies.

    You can also view and manage any Access Keys associated to the user.

MinIO Console Manage Groups

The Groups section displays all groups on the MinIO deployment.

This section is not visible for deployments using an external identity manager such as Active Directory or an OIDC-compatible provider.

  • Select Create Group to create a new MinIO Group.

    You can assign new users to the group during creation.

    You can assign policies to the group after creation.

  • Select the group row to open the details for that group.

    You can modify the group membership from the Members view.

    You can modify the group’s assigned policies from the Policies view.

Changing a user’s group membership modifies the policies that user inherits. See Access Management for more information.

MinIO Console Manage Policies

The Policies section displays all policies on the MinIO deployment. The Policies section allows you to create, modify, or delete policies.

Policies define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions a user, group of users, or access key can perform or conditions they must meet.

The policies are JSON formatted text files compatible with Amazon AWS Identity and Access Management policy syntax, structure, and behavior. Refer to Policy Based Action Control for details on managing access in MinIO with policies.

This section or its contents may not be visible if the authenticated user does not have the required administrative permissions.

  • Select + Create Policy to create a new MinIO Policy.

  • Select the policy row to manage the policy details.

    The Summary view displays a summary of the policy.

    The Users view displays all users assigned to the policy.

    The Groups view displays all groups assigned to the policy.

    The Raw Policy view displays the raw JSON policy.

Use the Users and Groups views to assign a created policy to users and groups, respectively.

Monitoring

The Monitoring section provides an interface for monitoring the MinIO deployment.

The section contains the following subsections: Some subsections may not be visible if the authenticated user does not have the required administrative permissions.

MinIO Console Metrics displaying point-in-time data

The Console Dashboard section displays metrics for the MinIO deployment. The default view provides a high-level overview of the deployment status, including the uptime and availability of individual servers and drives.

The Console also supports displaying time-series and historical data by querying a Prometheus service configured to scrape data from the MinIO deployment. Specifically, the MinIO Console uses Prometheus query API to retrieve stored metrics data and display historical metrics:

MinIO Console Metrics displaying simplified data

See MinIO Console Metrics Dashboard for more information on the historical metric visualization.

MinIO Console Logs displaying a list of server logs

The Console Logs section displays server logs generated by the MinIO Deployment.

  • Use the Nodes dropdown to filter logs to a subset of server nodes in the MinIO deployment.

  • Use the Log Types dropdown to filter logs to a subset of log types.

  • Use the Filter to apply text filters to the log results

Select the Start Logs button to begin collecting logs using the selected filters and settings.

The Audit Log section provides an interface for viewing audit logs collected by a configured PostgreSQL service.

The Audit Logging feature is configured and enabled automatically for MinIO deployments created using the MinIO Operator Console.

MinIO Console Trace

The Trace section provides HTTP trace functionality for a bucket or buckets on the deployment. This section provides similar functionality to mc admin trace.

You can modify the trace to show only specific trace calls. The default is to show only S3 related HTTP traces.

Select Filters to open additional filters to apply to trace output, such as restricting the Path on which the trace applies to a specific bucket or bucket prefix.

MinIO Console Watch

The Watch section displays S3 events as they occur on the selected bucket. This section provides similar functionality to mc watch.

MinIO Console Drive Health Status

The Drives section displays the healing status for a bucket. MinIO automatically heals objects and drives when it detects problems, such as drive-level corruption or a replacement drive.

Important

MinIO does not recommend performing manual healing unless explicitly directed by support.

Notifications

The Notifications section provides an interface to view, add, or remove Bucket Notification targets.

You can use this screen configure MinIO to push notification events to the one or more target destinations, including Redis, MySQL, Kafka, PostgreSQL, AMQP, MQTT, Elastic Search, NATS, NSQ, or a Webhook.

Select the Add Notification Target + button to add a new target to the deployment.

You can select an existing notification target from the list to view its details or delete the target.

The MinIO Console's Notification screen after selecting add new target that shows the types of destination targets users can add.

Tiers

MinIO Console Settings - Tiering

The Tiers section provides an interface for adding and managing remote tiers to support lifecycle management transition rules.

Select the Create Tier + button to add a new tier to the deployment. Choose to add a MinIO, Google Cloud Storage, AWS S3, or Azure tier type.

Existing tiers display with details of their configuration and an icon showing their current online or offline status.

You can select an existing tier from the list to view its details or make changes.

Site Replication

MinIO Console Settings - Site Replication

The Site Replication section provides an interface for adding and managing the site replication configuration for the deployment.

Configuring site replication requires that only a single site have existing buckets or objects (if any).

Settings

This section contains the following subsections. Some subsections may not be visible if the authenticated user does not have the required administrative permissions.

MinIO Console Settings - Configuration View

The Settings section provides an interface for viewing and retrieving configuration settings for all MinIO Servers in the deployment.

The interface functionality mimics that of using mc admin config get or mc admin config set. Refer to those commands for details on how to define the many options.

Some configuration settings may require restarting the MinIO deployment to apply changes.

Support

The Support section provides an interface for generating health and performance reports. Support functionality requires registering your deployment with MinIO SUBNET. Unregistered deployments display a Register Your Cluster button to register with your MinIO SUBNET account. See the License section in the Console or visit the MinIO SUBNET <https://min.io/pricing?jmp=docs> website for more information on registration.

This section contains the following subsections. Some subsections may not be visible if the authenticated user does not have the required administrative permissions.

MinIO Console - Health Diagnostics

The Health section provides an interface for running a health diagnostic for the MinIO Deployment.

The resulting health report is intended for use by MinIO Engineering via MinIO SUBNET and may contain internal or private data points such as hostnames. Exercise caution before sending a health report to a third party or posting the health report in a public forum.

MinIO Console - Performance Tests

The Performance section provides an interface for running a performance test of the deployment. The resulting test can provide a general guideline of deployment performance under S3 GET and PUT requests.

For more complete performance testing, consider using a combination of load-testing using your staging application environments and the MinIO WARP tool.

MinIO Console - Profile Tests

The Profile section provides an interface for running system profiling of the deployment. The results can provide insight into the MinIO server process running on a given node.

The resulting report is intended for use by MinIO Engineering via MinIO SUBNET. Independent or third-party use of these profiles for diagnostics and remediation is done at your own risk.

MinIO Console - Inspect an Object

The Inspect section provides an interface for capturing the erasure-coded metadata associated to an object or objects. MinIO Engineering may request this output as part of diagnostics in MinIO SUBNET.

The resulting object may be read using MinIO’s debugging tool. Independent or third-party use of the output for diagnostics or remediation is done at your own risk. You can optionally encrypt the object such that it can only be read if the generated encryption key is included as part of the debugging toolchain.

License

The License section displays information on the licensing status of the MinIO deployment.

For deployments not registered via MinIO SUBNET, the Console displays a table comparison of MinIO License and Support plans:

MinIO Console - License Plans

Existing customers can register the deployment with their MinIO SUBNET account by clicking Register this cluster in the top-right corner of the screen.

MinIO is Open Source software under the GNU AGPLv3 license. Applications using MinIO should follow local laws and regulations around licensing to ensure compliance with the AGPLv3 license, which may include open sourcing the application stack.

Proprietary application stacks can register for either the SUBNET Standard or Enterprise License and Support plan to use MinIO under a commercial license.

Documentation

The Documentation tab opens this documentation site in a separate browser window or tab.