Deploy the MinIO Operator

Kubernetes Version 1.19.0

Starting with v4.0.0, the MinIO Operator and MinIO Kubernetes Plugin require Kubernetes 1.19.0 and later. The Kubernetes infrastructure and the kubectl CLI tool must have the same version of 1.19.0+.

Prior to v4.0.0, the MinIO Operator and Plugin required Kubernetes 1.17.0. You must upgrade your Kubernetes infrastructure to 1.19.0 or later to use the MinIO Operator or Plugin v4.0.0 or later.

Starting with v5.0.0, MinIO recommends Kubernetes 1.21.0 or later for both the infrastructure and the kubectl CLI tool.

For Kubernetes 1.25.0 and later, MinIO supports deploying in environments with the Pod Security admission (PSA) restricted policy enabled.

kubectl Configuration

This procedure assumes that your local host machine has both the correct version of kubectl for your Kubernetes cluster and the necessary access to that cluster to create new resources.

Kubernetes TLS Certificate API

For any of these circumstances, the MinIO Operator requires that the Kubernetes kube-controller-manager configuration include the following configuration settings:

• --cluster-signing-key-file - Specify the PEM-encoded RSA or ECDSA private key used to sign cluster-scoped certificates.

• --cluster-signing-cert-file - Specify the PEM-encoded x.509 Certificate Authority certificate used to issue cluster-scoped certificates.

The Kubernetes TLS API uses the CA signature algorithm for generating new TLS certificate. MinIO recommends ECDSA (e.g. NIST P-256 curve) or EdDSA (e.g. Curve25519) TLS private keys/certificates due to their lower computation requirements compared to RSA. See Supported TLS Cipher Suites for a complete list of supported TLS Cipher Suites.

If the Kubernetes cluster is not configured to respond to a generated CSR, the Operator cannot complete initialization. Some Kubernetes providers do not specify these configuration values by default.

To check whether the kube-controller-manager specifies the cluster signing key and certificate files, use the following command:

kubectl get pod kube-controller-manager-$CLUSTERNAME-control-plane \
  -n kube-system -o yaml

• Replace $CLUSTERNAME with the name of the Kubernetes cluster.

Confirm that the output contains the highlighted lines. The output of the example command above may differ from the output in your terminal:

 spec:
 containers:
 - command:
     - kube-controller-manager
     - --allocate-node-cidrs=true
     - --authentication-kubeconfig=/etc/kubernetes/controller-manager.conf
     - --authorization-kubeconfig=/etc/kubernetes/controller-manager.conf
     - --bind-address=127.0.0.1
     - --client-ca-file=/etc/kubernetes/pki/ca.crt
     - --cluster-cidr=10.244.0.0/16
     - --cluster-name=my-cluster-name
     - --cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt
     - --cluster-signing-key-file=/etc/kubernetes/pki/ca.key
 ...

Configure MinIO Operator to Trust Custom Certificates

If you use custom certificates for your deployment, add the certificate so that MinIO Operator trusts it.

This procedure assumes you have an existing custom certificate.

1. Use the following command to generate a secret from the certificate:

   kubectl create secret generic MY-CUSTOM-TLS -n MY-CLUSTER-NAMESPACE --from-file=<path/to/public.crt>
   

   Replace the following placeholders in the above command: - MY-CUSTOM-TLS with the name of your secrets file - MY-CLUSTER-NAMESPACE with your cluster’s namespace - <path/to/public.crt> with the relative path to the public certificate to use to create the secret

2. Add a volume to the yaml for your cluster under .spec.template.spec

   volumes:
     - name: tls-certificates
       projected:
         defaultMode: 420
         sources:
           - secret:
               items:
                 - key: public.crt
                   path: CAs/custom-public.crt
               name: MY-CUSTOM-TLS
   

   • replace MY-CUSTOM-TLS with the name of your secrets file.

3. Add a volumeMount to the yaml for your cluster under .spec.template.spec.container[0]

   volumeMounts:
     - mountPath: /tmp/certs
       name: tls-certificates
   

1) Install the MinIO Kubernetes Plugin

The MinIO Kubernetes Plugin provides a command for initializing the MinIO Operator.

You can install the MinIO plugin using either the Kubernetes Krew plugin manager or manually by downloading and installing the plugin binary to your local host:

kubectl krew update
kubectl krew install minio

kubectl krew upgrade minio

kubectl minio version

curl https://github.com/minio/operator/releases/download/v5.0.9/kubectl-minio_5.0.9_linux_amd64 -o kubectl-minio
chmod +x kubectl-minio
mv kubectl-minio /usr/local/bin/

kubectl minio version

Invoke-WebRequest -Uri "https://github.com/minio/operator/releases/download/v5.0.9/kubectl-minio_5.0.9_windows_amd64.exe" -OutFile "C:\kubectl-plugins\kubectl-minio.exe"

kubectl minio version

2) Initialize the MinIO Kubernetes Operator

Run the kubectl minio init command to initialize the MinIO Operator:

kubectl minio init

The command initializes the MinIO Operator with the following default settings:

• Deploy the Operator into the minio-operator namespace. Specify the kubectl minio init --namespace argument to deploy the operator into a different namespace.

• Use cluster.local as the cluster domain when configuring the DNS hostname of the operator. Specify the kubectl minio init --cluster-domain argument to set a different cluster domain value.

3) Validate the Operator Installation

To verify the installation, run the following command:

kubectl get all --namespace minio-operator

If you initialized the Operator with a custom namespace, replace minio-operator with that namespace.

The output resembles the following:

NAME                                  READY   STATUS    RESTARTS   AGE
pod/console-59b769c486-cv7zv          1/1     Running   0          81m
pod/minio-operator-7976b4df5b-rsskl   1/1     Running   0          81m

NAME               TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
service/console    ClusterIP   10.105.218.94    <none>        9090/TCP,9443/TCP   81m
service/operator   ClusterIP   10.110.113.146   <none>        4222/TCP,4233/TCP   81m

NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/console          1/1     1            1           81m
deployment.apps/minio-operator   1/1     1            1           81m

NAME                                        DESIRED   CURRENT   READY   AGE
replicaset.apps/console-59b769c486          1         1         1       81m
replicaset.apps/minio-operator-7976b4df5b   1         1         1       81m

4) Open the Operator Console

Port Forwarding

Note

Some Kubernetes deployments may experience issues with timeouts during port-forwarding operations with the Operator Console. Select the NodePorts section to view instructions for alternative access. You can alternatively configure your preferred Ingress to grant access to the Operator Console service. See https://github.com/kubernetes/kubectl/issues/1368 for more information.

Run the kubectl minio proxy command to temporarily forward traffic from the MinIO Operator Console service to your local machine:

kubectl minio proxy

The command output includes a required token for logging into the Operator Console.

You can deploy a new MinIO Tenant from the Operator Dashboard.

kubectl get svc/console -n minio-operator -o json | jq -r '.spec.ports'

[
   {
      "name": "http",
      "nodePort": 31055,
      "port": 9090,
      "protocol": "TCP",
      "targetPort": 9090
   },
   {
      "name": "https",
      "nodePort": 31388,
      "port": 9443,
      "protocol": "TCP",
      "targetPort": 9443
   }
]

kubectl get secret/console-sa-secret -n minio-operator -o json | jq -r '.data.token' | base64 -d