New in version Operator: v5.0.7
Starting with Operator 5.0.7 and MinIO Server RELEASE.2023-04-20T17-56-55Z, you can use the SSH File Transfer Protocol (SFTP) to interact with the objects on a MinIO Operator Tenant deployment.
SFTP is defined by the Internet Engineering Task Force (IETF) as an extension of SSH 2.0. It allows file transfer over SSH for use with Transport Layer Security (TLS) and virtual private network (VPN) applications.
Enabling SFTP does not affect other MinIO features.
When enabled, MinIO supports the following SFTP operations:
MinIO does not support either
MinIO Operator only supports the SFTP file transfer protocol. Other protocols, such as FTP, are not supported for accessing Tenants.
SFTP clients can only operate on the latest version of an object. Specifically:
For read operations, MinIO only returns the latest version of the requested object(s) to the SFTP client.
For write operations, MinIO applies normal versioning behavior and creates a new object version at the specified namespace.
SFTP access requires the same authentication as any other S3 client. MinIO supports the following authentication providers:
MinIO IDP users and their service accounts
Active Directory/LDAP users and their service accounts
OpenID/OIDC service accounts
STS credentials cannot access buckets or objects over SFTP.
Authenticated users can access buckets and objects based on the policies assigned to the user or parent user account.
The SFTP protocol does not require any of the
You may not perform other MinIO admin actions with SFTP.
MinIO Operator v5.0.7 or later.
Enable an SFTP port (8022) for the server.
A port to use for the SFTP commands and a range of ports to allow the SFTP server to request to use for the data transfer.
Enable SFTP for the desired Tenant:
In the Operator Console, click on the Tenant for which to enable SFTP.
In the Configuration tab, toggle SFTP to Enabled.
Click Restart to restart MinIO and apply your changes.
Use the following Kubectl command to edit the Tenant YAML configuration:
kubectl edit tenants/my-tenant -n my-tenant-ns
my-tenant-nswith the desired Tenant and namespace.
features:section, set the value of
spec: configuration: name: my-tenant-env-configuration credsSecret: name: my-tenant-secret exposeServices: console: true minio: true features: enableSFTP: true
Kubectl restarts MinIO to apply the change.
If needed, configure ingress for the SFTP port according to your local policies.
Use your preferred SFTP client to connect to the MinIO deployment. You must connect as a user whose policies allow access to the desired buckets and objects.
The specifics of connecting to the MinIO deployment depend on your SFTP client. Refer to the documentation for your client.
The following examples use the SFTP CLI client on a Linux system.
The following example connects to an SFTP server, lists the contents of a bucket named
test-bucket, and downloads an object.
sftp -P 8022 my-access-key@localhost my-access-key@localhost's password: Connected to localhost. sftp> ls test-bucket sftp> ls test-bucket test-bucket/test-file.txt sftp> get test-bucket/test-file.txt Fetching /test-bucket/test-file.txt to test-file.txt test-file.txt 100% 6 1.3KB/s 00:00
kubectl get command uses yq to display the value of
enableSFTP, indicating whether SFTP is enabled:
kubectl get tenants/my-tenant -n my-tenant-ns -o yaml | yq '.spec.features'
my-tenant-ns with the desired Tenant and namespace.
If SFTP is enabled, the output resembles the following: