Deploy MinIO Operator on RedHat OpenShift

RedHat OpenShift 4.8+

The MinIO Kubernetes Operator is available starting with OpenShift 4.8+.

Red Hat Marketplace installation requires registration of the OpenShift cluster with the Marketplace for the necessary namespaces. See Register OpenShift cluster with Red Hat Marketplace for complete instructions.

For older versions of OpenShift, use the generic Deploy the MinIO Operator procedure.

Administrator Access

Installation of operators through the Red Hat Marketplace and the Operator Hub is restricted to OpenShift cluster administrators (cluster-admin privileges). This procedure requires logging into the Marketplace and/or OpenShift with an account that has those privileges.

OpenShift oc CLI

Download and Install the OpenShift CLI oc for use in this procedure.

1) Access the MinIO Operator Installation

Select the tab that corresponds to your preferred installation method:

Red Hat OperatorHub

Log into the OpenShift Web Console as a user with cluster-admin privileges.

From the Administrator panel, select Operators, then OperatorHub.

From the OperatorHub page, type “MinIO” into the Filter text entry. Select the MinIO Operator tile from the search list.

Select the MinIO Operator tile, then click Install to begin the installation.

Red Hat Marketplace

Open the MinIO Red Hat Marketplace listing in your browser. Click Login to log in with your Red Hat Marketplace account.

After logging in, click Purchase to purchase the MinIO Operator for your account.

After completing the purchase, click Workplace from the top navigation and select My Software.

Click MinIO Hybrid Cloud Object Storage and select Install Operator to start the Operator Installation procedure in OpenShift.

2) Configure and Deploy the Operator

The Install Operator page provides a walkthrough for configuring the MinIO Operator installation.

• For Update channel, select any of the available options.

• For Installation Mode, select All namespaces on the cluster

• For Installed Namespace, select openshift-operators

• For Approval Strategy, select the approval strategy of your choice.

See the Operator Installation Documentation Step 5 for complete descriptions of each displayed option.

Click Install to start the installation procedure. The web console displays a widget for tracking the installation progress.

Once installation completes, click View Operator to view the MinIO Operator page.

3) Configure TLS Certificates

If you have installed the MinIO Operator from Red Hat OperatorHub, the installation process also configures the OpenShift Service CA Operator. This Operator manages the TLS certificates required to access the MinIO Operator Console and Tenants. It automatically renews and rotates the certificates 13 months before expiration. No additional action is required.

For Operator installations deployed by other methods, configure the Service CA certificates manually. See the dropdowns below for details.

operator:
  env:
    - name: MINIO_OPERATOR_RUNTIME
      value: "OpenShift"
    - name: MINIO_CONSOLE_TLS_ENABLE
      value: "on"

  volumes:
    - name: sts-tls
      projected:
        sources:
          - secret:
              name: sts-tls
              items:
                - key: tls.crt
                  path: public.crt
                - key: tls.key
                  path: private.key
              optional: true
        defaultMode: 420
    - name: openshift-service-ca
      configMap:
        name: openshift-service-ca.crt
        items:
          - key: service-ca.crt
            path: service-ca.crt
        defaultMode: 420
        optional: true
    - name: openshift-csr-signer-ca
      projected:
        sources:
          - secret:
              name: openshift-csr-signer-ca
              items:
                - key: tls.crt
                  path: tls.crt
              optional: true
        defaultMode: 420
  volumeMounts:
    - name: openshift-service-ca
      mountPath: /tmp/service-ca
    - name: openshift-csr-signer-ca
      mountPath: /tmp/csr-signer-ca
    - name: sts-tls
      mountPath: /tmp/sts

4) Open the MinIO Operator Interface

You can find the MinIO Operator Interface from the Operators left-hand navigation header

1. Go to Operators, then Installed Operators.

2. For the Project dropdown, select openshift-operators.

3. Select MinIO Operators from the list of installed operators. The Status column must read Success to access the Operator interface.

5) Access the Operator Console

The MinIO Operator includes the Operator Console, a browser-based management interface for managed MinIO tenants.

kubectl patch service -n minio-operator console -p '
{
    "spec": {
        "ports": [
            {
                "name": "http",
                "port": 9090,
                "protocol": "TCP",
                "targetPort": 9090,
                "nodePort": 30090
            },
            {
                "name": "https",
                "port": 9443,
                "protocol": "TCP",
                "targetPort": 9443,
                "nodePort": 30433
            }
        ],
        "type": "NodePort"
    }
}'

kubectl get secret/console-sa-secret -n minio-operator -o json | jq -r '.data.token' | base64 -d

You can create a permanent routing rule by creating a Route or Ingress to allow access from external clients, such as your local computer browser.

The following steps provides a summary of actions necessary to create a Route.

1. From Networking, go to Routes

2. Create a new Route in the MinIO Operator project. Select a recognizable route name, such as operator-console-route.

3. Set the Hostname as per your organizations networking and hostname topology. Omit the hostname to allow OpenShift to generate it automatically

4. Set the Service to console

5. Set the Target Port to 9090

You can then access the Operator Console using the configured Route. The Operator Console still requires using the generated JWT token for access, which you can generate at any time using oc minio port-forward.

6) Next Steps

After deploying the MinIO Operator, you can create a new MinIO Tenant. To deploy a MinIO Tenant using OpenShift, see Deploy a Tenant using the OpenShift Web Console.