Deploy the MinIO Operator

Kubernetes Version v1.30.10

MinIO tests 7.1.1 against a floor of Kubernetes API of v1.30.10. MinIO strongly recommends maintaining Kubernetes infrastructure using actively maintained Kubernetes API versions.

MinIO strongly recommends upgrading Kubernetes clusters running with End-Of-Life API versions

Kustomize and kubectl

Kustomize is a YAML-based templating tool that allows you to define Kubernetes resources in a declarative and repeatable fashion. Kustomize is included with the kubectl command line tool.

This procedure assumes that your local host machine has both the matching version of kubectl for your Kubernetes cluster and the necessary access to that cluster to create new resources.

The default MinIO Operator Kustomize template provides a starting point for customizing configurations for your local environment. You can modify the default Kustomization file or apply your own patches to customize the Operator deployment for your Kubernetes cluster.

Kubernetes TLS Certificate API

For any of these circumstances, the MinIO Operator requires that the Kubernetes kube-controller-manager configuration include the following configuration settings:

• --cluster-signing-key-file - Specify the PEM-encoded RSA or ECDSA private key used to sign cluster-scoped certificates.

• --cluster-signing-cert-file - Specify the PEM-encoded x.509 Certificate Authority certificate used to issue cluster-scoped certificates.

The Kubernetes TLS API uses the CA signature algorithm for generating new TLS certificate. MinIO recommends ECDSA (e.g. NIST P-256 curve) or EdDSA (e.g. Curve25519) TLS private keys/certificates due to their lower computation requirements compared to RSA. See Supported TLS Cipher Suites for a complete list of supported TLS Cipher Suites.

If the Kubernetes cluster is not configured to respond to a generated CSR, the Operator cannot complete initialization. Some Kubernetes providers do not specify these configuration values by default.

To check whether the kube-controller-manager specifies the cluster signing key and certificate files, use the following command:

kubectl get pod kube-controller-manager-$CLUSTERNAME-control-plane \
  -n kube-system -o yaml

• Replace $CLUSTERNAME with the name of the Kubernetes cluster.

Confirm that the output contains the highlighted lines. The output of the example command above may differ from the output in your terminal:

 spec:
 containers:
 - command:
     - kube-controller-manager
     - --allocate-node-cidrs=true
     - --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
     - --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf
     - --bind-address=127.0.0.1
     - --client-ca-file=/etc/kubernetes/pki/ca.crt
     - --cluster-cidr=10.244.0.0/16
     - --cluster-name=my-cluster-name
     - --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt
     - --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
 ...

Certificate Management with cert-manager

Rather than the MinIO Operator managing certificates, you can configure the deployment to use cert-manager. For instructions for deploying the MinIO Operator and tenants using cert-manager, refer to the cert-manager page.

Install the MinIO Operator using Kustomize

The following procedure uses kubectl -k to install the Operator from the MinIO Operator GitHub repository. kubectl -k and kubectl --kustomize are aliases that perform the same command.

1. Install the latest version of Operator

   The following command installs the Operator to the minio-operator namespace:

   kubectl apply -k "github.com/minio/operator?ref=v7.1.1"
   

   The command outputs a list of installed resources.

2. Verify the Operator pods are running:

   kubectl get pods -n minio-operator
   

   The output resembles the following:

   NAME                              READY   STATUS              RESTARTS   AGE
   minio-operator-6c758b8c45-nkhlx   1/1     Running   0          2m42s
   minio-operator-6c758b8c45-dgd8n   1/1     Running   0          2m42s
   

   In this example, the minio-operator pod is MinIO Operator and the console pod is the Operator Console.

   You can modify your Operator deployment by applying kubectl patches. You can find examples for common configurations in the Operator GitHub repository.

3. Verify the Operator installation

   Check the contents of the specified namespace (minio-operator) to ensure all pods and services have started successfully.

   kubectl get all -n minio-operator
   

   The response should resemble the following:

   NAME                                  READY   STATUS    RESTARTS   AGE
   pod/minio-operator-6c758b8c45-nkhlx   1/1     Running   0          5m20s
   pod/minio-operator-6c758b8c45-dgd8n   1/1     Running   0          5m20s
   
   NAME               TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                         AGE
   service/operator   ClusterIP   10.43.135.241   <none>        4221/TCP                        5m20s
   service/sts        ClusterIP   10.43.117.251   <none>        4223/TCP                        5m20s
   
   NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/minio-operator   2/2     2            2           5m20s
   
   NAME                                        DESIRED   CURRENT   READY   AGE
   replicaset.apps/minio-operator-6c758b8c45   2         2         2       5m20s
   

4. Next Steps

   You can deploy MinIO tenants using the MinIO CRD and Kustomize. MinIO also provides a Helm chart for deploying Tenants.

   MinIO recommends using the same method of Tenant deployment and management used to install the Operator. Mixing Kustomize and Helm for Operator or Tenant management may increase operational complexity.