MinIO Ingress on Kind for testing and learning - cniackz/public GitHub Wiki

Ingress

Please read these documents:

Then deploy this cluster 9443 for console 443 for minio:

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: InitConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        node-labels: "ingress-ready=true"
  extraPortMappings:
  - containerPort: 9443
    hostPort: 9443
    protocol: TCP
  - containerPort: 443
    hostPort: 443
    protocol: TCP
- role: worker
  extraPortMappings:
  - containerPort: 30081
    hostPort: 30081
    listenAddress: "127.0.0.1"
    protocol: TCP
- role: worker
  extraPortMappings:
  - containerPort: 30082
    hostPort: 30082
    listenAddress: "127.0.0.1"
    protocol: TCP
- role: worker
  extraPortMappings:
  - containerPort: 30083
    hostPort: 30083
    listenAddress: "127.0.0.1"
    protocol: TCP
- role: worker
  extraPortMappings:
  - containerPort: 30084
    hostPort: 30084
    listenAddress: "127.0.0.1"
    protocol: TCP

Install Ingress NGINX:

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml

Now the Ingress is all setup. Wait until is ready to process requests running:

kubectl wait --namespace ingress-nginx \
  --for=condition=ready pod \
  --selector=app.kubernetes.io/component=controller \
  --timeout=90s

Add --enable-ssl-passthrough to enable passthrough in ingress-nginx deployment:

apiVersion: apps/v1
kind: Deployment
...
spec:
  template:
    spec:
      containers:
      - args:
          ...
          - --enable-ssl-passthrough

Install Operator

installoperator kustomize

Install Tenant

installtenant kustomize

Create Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  namespace: tenant-lite
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
    - hosts:
        - minio.tenant-lite.svc.cluster.local
        - minio.tenant-lite
      secretName: myminio-tls
  rules:
    - host: minio.tenant-lite.svc.cluster.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: minio
                port:
                  number: 443
    - host: minio.tenant-lite
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myminio-console
                port:
                  number: 9443

Explanation: It forward a trusted URL to a k8s Service, in this case to minio and console!.

Buy a domain with TLS or modify your /etc/hosts

127.0.0.1 minio.tenant-lite.svc.cluster.local
127.0.0.1 minio.tenant-lite

Create a file with this content to trust certificate if you did not buy one:

namespace      | secret             | key
---------------+--------------------+------------------------
minio-operator | console-sa-secret  | ca.crt <--- First put this content
default        | cesar-tls          | public.crt <------ Then put this content

Example:

Add above file to Keychain Access App if on Mac to trust certs if you did not buy the domain/cert.

Now you can create the alias as if you were inside the cluster:

Cesars-MacBook-Pro:~ cniackz$ mc alias set myminio https://minio.tenant-lite.svc.cluster.local minio minio123
Added `myminio` successfully.

And you can access console UI in a trusted certificate:

https://minio.tenant-lite/login
User: minio
Password: minio123