Operator UI via HTTPS - cniackz/public GitHub Wiki

Objective:

Expose Operator UI via HTTPS

Inspired from Daniel's note:

> to do that just add the certificates as a secret to the deployment of console, mount it and that's it
> in theory you can do a CSR for console
> if needed a certificate via CSR we need to add that step

Console TLS.pdf

Steps:

1. Assuming you have a k8s cluster ready

2. Install the operator:

k apply -k github.com/minio/operator/resources/\?ref\=v4.5.4

3. Scale Down Operator Replicas to One.

4. Reusing the Operator Certificate, modify the console deployment like this:

spec:
  template:
    spec:
      volumes: <----------------------------- 1. Use secret as a volume
        - name: tls-certificates
          projected:
            sources:
              - secret:
                  name: operator-tls
                  items:
                    - key: public.crt
                      path: CAs/public.crt
                    - key: public.crt
                      path: public.crt
                    - key: private.key
                      path: private.key
            defaultMode: 420
      containers:
        - name: console
          image: minio/console:v0.21.1
          args:
            - server
            - '--certs-dir=/tmp/certs' <--------- 2. Provide the certs to console binary
          ports:
            - name: http
              containerPort: 9090
              protocol: TCP
            - name: https
              containerPort: 9433
              protocol: TCP
          env:
            - name: CONSOLE_OPERATOR_MODE
              value: 'on'
          resources: {}
          volumeMounts:
            - name: tls-certificates
              mountPath: /tmp/certs <---------------------- 3. To allow console getting those certs
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            runAsNonRoot: true
      restartPolicy: Always

5. Console will be serving at 9443

Serving operator at http://[::]:9090
Serving operator at https://[::]:9443

6. Now you can do this:

$ k port-forward svc/console 9443 -n minio-operator
Forwarding from 127.0.0.1:9443 -> 9443
Forwarding from [::1]:9443 -> 9443
Handling connection for 9443
Handling connection for 9443
Handling connection for 9443
Handling connection for 9443
Handling connection for 9443
Handling connection for 9443
Handling connection for 9443
Handling connection for 9443

7. And access UI via Browser: https://localhost:9443/tenants