Skip to content

operator‐1791

Jump to bottom
Allan Roger Reid edited this page Jul 23, 2024 · 4 revisions

Build and install the minio operator

kubectl delete namespace/minio-operator
rm -rf ~/github/operator && mkdir -p ~/github/operator && cd ~/github && git clone https://github.com/minio/operator.git && cd operator

TAG=localhost/minio/operator:noop
GITHUB_WORKSPACE=operator
CI="true"
SCRIPT_DIR=testing

make binary
(cd "${SCRIPT_DIR}/.." && docker build -t $TAG .)
kind load docker-image $TAG --name kind-cluster
kubectl patch deployment -n minio-operator minio-operator -p '{"spec":{"replicas":1, "template":{"spec":{"containers":[{"name": "minio-operator", "image": "'$TAG'"}]}}}}'
kubectl -n minio-operator delete pods -l app.kubernetes.io/name=operator

Apply a tenant

Kustomize
Uncomment # certExpiryAlertThreshold: 1 from examples/kustomization/base/tenant.yaml
kubectl -k examples/kustomization/tenant-lite
Helm
Uncomment # certExpiryAlertThreshold: 1 from helm/tenant/values.yaml
helm package ~/Projects/operator/helm/tenant
kubectl delete ns tenant-lite-helm
helm install --namespace tenant-lite-helm --create-namespace tenant-lite-helm ~/Downloads/tenant-6.0.0.tgz

Create expired and expiring certificates as in https://github.com/allanrogerr/public/wiki/Console%3A-add-time-left-to-certificates-%231130

Create secrets based on these

cat server-expired.crt | base64
cat server-expiring.crt | base64
cat server.key | base64

Apply the secrets as external certificates

cat << EOF > myminio-external-server-certificate-0-secret.yaml
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuakNDQW9hZ0F3SUJBZ0lVRTExbkg3OHJ6VWo1WWdSNGRHYjk2QXVWdWR3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd05qRVBNQTBHQTFVRUF3d0diV2x1TG1sdk1Rc3dDUVlEVlFRR0V3SlZVekVXTUJRR0ExVUVCd3dOVTJGdQpJRVp5WVc1amFYTmpiekFlRncweU5EQTNNREV3TnpBd01EQmFGdzB5TkRBM01ESXdOekF3TURCYU1HMHhDekFKCkJnTlZCQVlUQWxWVE1STXdFUVlEVlFRSURBcERZV3hwWm05eWJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmgKYm1OcGMyTnZNUk13RVFZRFZRUUtEQXBOYVc1SlR5QkpibU11TVFzd0NRWURWUVFMREFKSVVURVBNQTBHQTFVRQpBd3dHYldsdUxtbHZNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXBZNk5qUjVjCktwSmd0S1JiTDFKMmJoajRKbHJvSzlMVkEwdFZ0eXlMUW04WGhabVc0aWttSWxDQlNmc3RiSEVWaStNMUhUaWgKZGhHcmtqcTJPUVFOMnRHbVNGU1hVa3c0aDdJb1hRalNMM0tPUllkMUYwUTlNaUhTcnNLaXo0MlVmbFVpMDVNZQpsazA4U0lHR3l6ZEFJc09veUNBcUFQRzBTSGZ0Z0xKTGxBOGhHcG9XVEMwam9LR3d3TnFkM0tLQmhreDRMMVBRCkZXSDVRUjBFZW1HVFJaNVBqTnhOWnBrd0hNbFJKcGVLS2o2NFA1K2xOVUx6bWd5dzNLeUduR0J2T2tEQW1US2EKQXNVTUlWbHp2elhnTkVjMk1ydGkwa3ZUc0dhbkU2VHdsTTJEd3FMUjV6OTVjdFppTmw3WDN4cEJJTnBjNklTQgppb21hMmhDV3gzS2wzUUlEQVFBQm8yMHdhekFmQmdOVkhTTUVHREFXZ0JSSGg0Smk4c2s3VHk2cDNxT1EvZXpkCnVoc2dHVEFKQmdOVkhSTUVBakFBTUFzR0ExVWREd1FFQXdJRThEQVJCZ05WSFJFRUNqQUlnZ1p0YVc0dWFXOHcKSFFZRFZSME9CQllFRk05WmM0YUFDU2w5MXhlYjVOQXdQZHB0UTMxVU1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQgpBUUJ3WUQrSFdNUTFldXBVdnkyQm83dHB4aGdsUWdldnk0cWFHTWhqL1N5NGprUHRPSXE4MFo5cnFNTzM2TzB0CmJrZ2oyYnJxbEhJbHRuMHcrNklDb0RyV2lSZDVJRnA4aEtsclBkZ0c1MmVLZ0lBaXRKZjcyQ0w3VlBvMFVWZ2gKZENZSkZIYy9NSWJoNGsyM2ZrVno2cmx4R0J1Szd2VEhXcUllQlc1Tkl1YzVUenRVZ1ZydituQnliMTgwRFBWKwpFcDYvV2hQTzJxWlFFQnZqd3cxR3YvNkQvR0NiQVd6Qm93UFB3dkVGUnlHbWlTay9lc0xRNGovR1llaUdGajRtCjYxTmF3c0QvOFNRZmZqWmZDazIxb25ZSXpFR3VGTWpmYitOQkFxVmgyL1pONEhlZllPYWc4ZUZYRWFHT2xPaWEKL1F4SWRDUnlqYXVISGQzeTZuR3NQU2VXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2xqbzJOSGx3cWttQzAKcEZzdlVuWnVHUGdtV3VncjB0VURTMVczTEl0Q2J4ZUZtWmJpS1NZaVVJRkoreTFzY1JXTDR6VWRPS0YyRWF1UwpPclk1QkEzYTBhWklWSmRTVERpSHNpaGRDTkl2Y281RmgzVVhSRDB5SWRLdXdxTFBqWlIrVlNMVGt4NldUVHhJCmdZYkxOMEFpdzZqSUlDb0E4YlJJZCsyQXNrdVVEeUVhbWhaTUxTT2dvYkRBMnAzY29vR0dUSGd2VTlBVllmbEIKSFFSNllaTkZuaytNM0UxbW1UQWN5VkVtbDRvcVByZy9uNlUxUXZPYURMRGNySWFjWUc4NlFNQ1pNcG9DeFF3aApXWE8vTmVBMFJ6WXl1MkxTUzlPd1pxY1RwUENVellQQ290SG5QM2x5MW1JMlh0ZmZHa0VnMmx6b2hJR0tpWnJhCkVKYkhjcVhkQWdNQkFBRUNnZjlyUXdZUFJIaTVjWnp1K3NZMXNPbHRsaU5wSi96RUx2ZzNJeERlc2VnV0RXUEYKVHRLSU5MMUFOeE1iS2JhOUx4Vk52bUFIby9kcDhrLzJyY3czTXJkeDZvMTB6MW1RVk4vMTdrVzRjdHNRRFV2WQo2ditIS05LWm9VSVFsRkVTVXBMNERjMG1IREpteTBBRFpKS3dlbmZoWTM5VFJpNHBmS2k3OWFJT1l6ejMwc2ttCmdXY2x1YkdhdWFsZjFuYnVTMkg3YWxjUm04MEVRWWV3MWgySWsra3NuZVUrczl2ZnBEVGZTRFdYUjlZNkQreEMKemRNN1o1U3V5ZmNnUkRuU3o4LzVtRFV6b3h6bllUNmMvTFlsMXo3UVZQdFZBNzNYRktPZDhKeWxRZ0JHVS9ZbgpZSC80dmZvWUphSWgzWUVsWGtWbkw3T2oyYkUwYXZQOVl6QlBIZmtDZ1lFQTVlUWtDd3FjN3JMSDBZbEpiWDdzCngzaFVVdjB0RW5aWWEwUngyVXBmN05VY1dWb3QwQmoyQ082dXh1QmY1aVZtb0RFc2I0RFUvcXIyZmFFbER6WWwKQkVnMFlXa0JNRUVtb3QwRXNYTkpUZHJFdGQrVmJVTWZRckRZUUFVNmZoRUxZTmFPT1g4b05nQkFPd1JEQ3c4cQpNWkMybVQyYnhFVHJRWWV4TmxyR0hBa0NnWUVBdUZ2MGU0Vnk5R2pQVE4wRXViU085Tllvc2hxYll5MnRRc2hhCnNZcHQ4eU0veVEwRC9jTzJKcS84ZlFJRlB5c0hjL051cVRHOUFVWitTS0VWSXN5RGxFTVlUd29FYkthL2ZzSGsKM3hJdGo5YTE5eUhrU3BhRjBhV3pBYkwrMG1xT0c5Vk9jOFRMN1hzT1J3Rjk1aGN0SE5Jd05SOW5JaHlzKzRjWQpxTXJlR0RVQ2dZRUEybEtLaEUzazhhK3BvbTRONU1YWVdpc0ZjZmJzZWc4WU0yN0I3RWo4eG04eFNBNGpXZkNLCm43c0ZFdXY5UnhVWDNHUTJ2Z0lNeFhwWk1yLzU4UE5MdmtCUU5uNUJXYkZWM3UrbFNGeWpMaVBvRW8wdVhLQ1YKTElIRUxUQ0o5elY2cDlHN0toRi9mNkZIWG9UU29zc1pHQTlGeWt3L0JPc3F2SVlBSHcyZi9Qa0NnWUVBczY4VQpLeXZXN2JZVmpjSEE4RXEySnBWd2xwNXVJbzBMV0pLMEttUlVZMnhRcCtEaXFmdU5Wa21pV2lpVStvc3l1V1ZpCnpzOG1lczY5R0lhL2RlcEV1RVZvdE9oN2hYWkVJQVJVME1JRDNEU1ZwK2ZGZkprV2xrM2NtV1JmRHJCQ0Q0aW4KN1JlNjlweEFQeDZLR2E4dkRlOGlnelEzTGIwckwvL3RIZDZUOXAwQ2dZQkthbTZGTUJwVzZOc3A4SERJcjdDcApTZE1xWnRGblFSaDBFMXlvUS9iQ0RkZENyT1VqRFJybldYS2hmMVlkbjJPaVQ2dGViQjgwcVdvdnVVSmUxR3lPClBQZUpTN3drTjdqYTNLV2dEd3ZGUnlRbldncTh1bm5uTUlMOUtBeUxCMmlmR1VvdmQ3OUFQaGdWOWZpZTVGZlYKYVovK1FkbkwyR2cxcldCbGp2RE0wQT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  labels:
    v1.min.io/tenant: myminio
  name: myminio-external-server-certificate-0
  namespace: tenant-lite-helm
type: kubernetes.io/tls
EOF

kubectl apply -f myminio-external-server-certificate-0-secret.yaml

cat << EOF > myminio-external-server-certificate-1-secret.yaml
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuakNDQW9hZ0F3SUJBZ0lVRTExbkg3OHJ6VWo1WWdSNGRHYjk2QXVWdWRvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd05qRVBNQTBHQTFVRUF3d0diV2x1TG1sdk1Rc3dDUVlEVlFRR0V3SlZVekVXTUJRR0ExVUVCd3dOVTJGdQpJRVp5WVc1amFYTmpiekFlRncweU5EQTNNVGt3TnpBd01EQmFGdzB5TkRBNE1EZ3dOekF3TURCYU1HMHhDekFKCkJnTlZCQVlUQWxWVE1STXdFUVlEVlFRSURBcERZV3hwWm05eWJtbGhNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmgKYm1OcGMyTnZNUk13RVFZRFZRUUtEQXBOYVc1SlR5QkpibU11TVFzd0NRWURWUVFMREFKSVVURVBNQTBHQTFVRQpBd3dHYldsdUxtbHZNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXBZNk5qUjVjCktwSmd0S1JiTDFKMmJoajRKbHJvSzlMVkEwdFZ0eXlMUW04WGhabVc0aWttSWxDQlNmc3RiSEVWaStNMUhUaWgKZGhHcmtqcTJPUVFOMnRHbVNGU1hVa3c0aDdJb1hRalNMM0tPUllkMUYwUTlNaUhTcnNLaXo0MlVmbFVpMDVNZQpsazA4U0lHR3l6ZEFJc09veUNBcUFQRzBTSGZ0Z0xKTGxBOGhHcG9XVEMwam9LR3d3TnFkM0tLQmhreDRMMVBRCkZXSDVRUjBFZW1HVFJaNVBqTnhOWnBrd0hNbFJKcGVLS2o2NFA1K2xOVUx6bWd5dzNLeUduR0J2T2tEQW1US2EKQXNVTUlWbHp2elhnTkVjMk1ydGkwa3ZUc0dhbkU2VHdsTTJEd3FMUjV6OTVjdFppTmw3WDN4cEJJTnBjNklTQgppb21hMmhDV3gzS2wzUUlEQVFBQm8yMHdhekFmQmdOVkhTTUVHREFXZ0JSSGg0Smk4c2s3VHk2cDNxT1EvZXpkCnVoc2dHVEFKQmdOVkhSTUVBakFBTUFzR0ExVWREd1FFQXdJRThEQVJCZ05WSFJFRUNqQUlnZ1p0YVc0dWFXOHcKSFFZRFZSME9CQllFRk05WmM0YUFDU2w5MXhlYjVOQXdQZHB0UTMxVU1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQgpBUUF6SHhUajF5N0g5SjA4azNzL0tTMDFyeHdlc2R6MW1zUTROVVIwOWw0L2NxREswRkRLdnI0YlA2emNDQmo3CmY2VDZkRHpXb0J1Nmk3cHFvNmhJMlczSForbjQrUmFIK3JuT2JFd2s0akhHN3BiaVA3cjlvZjRCVDIxYnBpaloKZnBPWnphaUhKMHNCQmpEQ2xzTTZjYVNqWlNaL0I1QTlMd01yR2JwM2pjOUYzZDc3M29BemVLcWN3Y1VoYjJhagpKdW11T3ZGZVg0YnJJaXJoQXpXdXdVdlZjSy9ZMC9WcHE2L0FJU3dPeEN5MXlWMi8rOXhBb2FMY1YvZTE5RlNmCllKMklGRE1vRnZ1M3pxSDdEblgxc0N4OVVoQVF4UTJkaDNFcDF5MkhtQWdzMGFXcUNRY1o5UDBGUGVMa0JyUTIKdDRCa0JlZURSQ1k0SXFjakdGeGEvdW1BCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2xqbzJOSGx3cWttQzAKcEZzdlVuWnVHUGdtV3VncjB0VURTMVczTEl0Q2J4ZUZtWmJpS1NZaVVJRkoreTFzY1JXTDR6VWRPS0YyRWF1UwpPclk1QkEzYTBhWklWSmRTVERpSHNpaGRDTkl2Y281RmgzVVhSRDB5SWRLdXdxTFBqWlIrVlNMVGt4NldUVHhJCmdZYkxOMEFpdzZqSUlDb0E4YlJJZCsyQXNrdVVEeUVhbWhaTUxTT2dvYkRBMnAzY29vR0dUSGd2VTlBVllmbEIKSFFSNllaTkZuaytNM0UxbW1UQWN5VkVtbDRvcVByZy9uNlUxUXZPYURMRGNySWFjWUc4NlFNQ1pNcG9DeFF3aApXWE8vTmVBMFJ6WXl1MkxTUzlPd1pxY1RwUENVellQQ290SG5QM2x5MW1JMlh0ZmZHa0VnMmx6b2hJR0tpWnJhCkVKYkhjcVhkQWdNQkFBRUNnZjlyUXdZUFJIaTVjWnp1K3NZMXNPbHRsaU5wSi96RUx2ZzNJeERlc2VnV0RXUEYKVHRLSU5MMUFOeE1iS2JhOUx4Vk52bUFIby9kcDhrLzJyY3czTXJkeDZvMTB6MW1RVk4vMTdrVzRjdHNRRFV2WQo2ditIS05LWm9VSVFsRkVTVXBMNERjMG1IREpteTBBRFpKS3dlbmZoWTM5VFJpNHBmS2k3OWFJT1l6ejMwc2ttCmdXY2x1YkdhdWFsZjFuYnVTMkg3YWxjUm04MEVRWWV3MWgySWsra3NuZVUrczl2ZnBEVGZTRFdYUjlZNkQreEMKemRNN1o1U3V5ZmNnUkRuU3o4LzVtRFV6b3h6bllUNmMvTFlsMXo3UVZQdFZBNzNYRktPZDhKeWxRZ0JHVS9ZbgpZSC80dmZvWUphSWgzWUVsWGtWbkw3T2oyYkUwYXZQOVl6QlBIZmtDZ1lFQTVlUWtDd3FjN3JMSDBZbEpiWDdzCngzaFVVdjB0RW5aWWEwUngyVXBmN05VY1dWb3QwQmoyQ082dXh1QmY1aVZtb0RFc2I0RFUvcXIyZmFFbER6WWwKQkVnMFlXa0JNRUVtb3QwRXNYTkpUZHJFdGQrVmJVTWZRckRZUUFVNmZoRUxZTmFPT1g4b05nQkFPd1JEQ3c4cQpNWkMybVQyYnhFVHJRWWV4TmxyR0hBa0NnWUVBdUZ2MGU0Vnk5R2pQVE4wRXViU085Tllvc2hxYll5MnRRc2hhCnNZcHQ4eU0veVEwRC9jTzJKcS84ZlFJRlB5c0hjL051cVRHOUFVWitTS0VWSXN5RGxFTVlUd29FYkthL2ZzSGsKM3hJdGo5YTE5eUhrU3BhRjBhV3pBYkwrMG1xT0c5Vk9jOFRMN1hzT1J3Rjk1aGN0SE5Jd05SOW5JaHlzKzRjWQpxTXJlR0RVQ2dZRUEybEtLaEUzazhhK3BvbTRONU1YWVdpc0ZjZmJzZWc4WU0yN0I3RWo4eG04eFNBNGpXZkNLCm43c0ZFdXY5UnhVWDNHUTJ2Z0lNeFhwWk1yLzU4UE5MdmtCUU5uNUJXYkZWM3UrbFNGeWpMaVBvRW8wdVhLQ1YKTElIRUxUQ0o5elY2cDlHN0toRi9mNkZIWG9UU29zc1pHQTlGeWt3L0JPc3F2SVlBSHcyZi9Qa0NnWUVBczY4VQpLeXZXN2JZVmpjSEE4RXEySnBWd2xwNXVJbzBMV0pLMEttUlVZMnhRcCtEaXFmdU5Wa21pV2lpVStvc3l1V1ZpCnpzOG1lczY5R0lhL2RlcEV1RVZvdE9oN2hYWkVJQVJVME1JRDNEU1ZwK2ZGZkprV2xrM2NtV1JmRHJCQ0Q0aW4KN1JlNjlweEFQeDZLR2E4dkRlOGlnelEzTGIwckwvL3RIZDZUOXAwQ2dZQkthbTZGTUJwVzZOc3A4SERJcjdDcApTZE1xWnRGblFSaDBFMXlvUS9iQ0RkZENyT1VqRFJybldYS2hmMVlkbjJPaVQ2dGViQjgwcVdvdnVVSmUxR3lPClBQZUpTN3drTjdqYTNLV2dEd3ZGUnlRbldncTh1bm5uTUlMOUtBeUxCMmlmR1VvdmQ3OUFQaGdWOWZpZTVGZlYKYVovK1FkbkwyR2cxcldCbGp2RE0wQT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  labels:
    v1.min.io/tenant: myminio
  name: myminio-external-server-certificate-1
  namespace: tenant-lite-helm
type: kubernetes.io/tls
EOF

kubectl apply -f myminio-external-server-certificate-1-secret.yaml

kubectl patch tenant -n tenant-lite-helm myminio --type='merge' -p  '{"spec":{"externalCertSecret": [{"name": "myminio-external-server-certificate-0","type": "kubernetes.io/tls"},{"name": "myminio-external-server-certificate-1","type": "kubernetes.io/tls"}] }}'

Experiment with different values of certExpiryAlertThreshold e.g.

kubectl patch tenant -n tenant-lite-helm myminio --type='merge' -p  '{"spec":{"certExpiryAlertThreshold": 25 }}'

Observe

  • if certExpiryAlertThreshold is not present then all certificate expiry events are reported
  • if the whole number of days left for a certificate to expire is less than certExpiryAlertThreshold then this certificate expiry events are reported
  • if the whole number of days left for a certificate to expire is greater than or equal to certExpiryAlertThreshold then this certificate expiry events are not reported
  • expired certificate events are always reported
image
Clone this wiki locally