Modify a MinIO Tenant

Review Certificate expiration

A message displays under the certificate with the date of expiration and length of time until expiration.

The message adjusts depending on the length of time to expiration:

• More than 30 days, the message text displays in gray.

• Within 30 days, the message text changes to orange.

• Within 10 days, the message text changes to red.

• Within 24 hours, the message displays as an hour and minute countdown in red text.

• After expiration, the message displays as EXPIRED.

Modify Tenant TLS Configuration

The MinIO Operator Console supports adding and removing TLS certificates from a MinIO Tenant.

From the Operator Console view, select the Tenant to open the summary view, then select Security. You can make the following modifications:

Enable or Disable TLS

Toggle the TLS switch to direct the Operator to either enable or disable TLS for the deployment. The MinIO Operator automatically generates the necessary TLS certificates using the Kubernetes TLS API. See Enabling TLS for more information.

Add Custom TLS Certificates

MinIO Tenants support Server Name Indication (SNI), where the MinIO server identifies which certificate to use based on the hostname specified by the connecting client. The MinIO Operator can attach additional TLS certificates to the Tenant to enable SNI-based TLS connectivity.

To customize the TLS certificates mounted on the MinIO Tenant, enable the Custom Certificates switch. Select the Add Certificate + button to add custom TLS certificates.

Add Trusted Certificate Authorities

The MinIO Tenant validates the TLS certificate presented by each connecting client against the host system’s trusted root certificate store. The MinIO Operator can attach additional third-party Certificate Authorities (CA) to the Tenant to allow validation of client TLS certificates signed by those CAs.

To customize the trusted CAs mounted to each Tenant MinIO pod, enable the Custom Certificates switch. Select the Add CA Certificate + button to add third party CA certificates.

If the MinIO Tenant cannot match an incoming client’s TLS certificate issuer against either the container OS’s trust store or an explicitly attached CA, MinIO rejects the connection as invalid.

Specify Runtime Class

When adding a new pool or modifying an existing pool for a tenant, you can specify the Runtime Class Name for pools to use.

Decommission a Tenant Server Pool

MinIO Operator 4.4.13 and later support decommissioning a server pool in a Tenant. Specifically, you can follow the Decommission a Server pool procedure to remove the pool from the tenant, then edit the tenant YAML to drop the pool from the StatefulSet. When removing the Tenant pool, ensure the spec.pools.[n].name fields have values for all remaining pools.