minio/docs
1
0
Fork 0
mirror of https://github.com/minio/docs.git synced 2025-07-28 19:42:10 +03:00
Code Activity

Cleaning up Network Encryption pages

Browse Source
This commit is contained in:
Ravind Kumar
2022-06-22 17:02:08 -04:00
committed by Ravind Kumar
parent 8d15d1714a
commit 1c416561ef
7 changed files with 364 additions and 246 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
source/operations/install-deploy-manage/deploy-minio-tenant.rst
View File

@ -381,6 +381,8 @@ This includes configuring an external IDP such as :ref:`OpenID <minio-external-i
.. _create-tenant-security-section:
.. _minio-k8s-deploy-minio-tenant-security:
7) The :guilabel:`Security` Section
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

38
source/operations/install-deploy-manage/modify-minio-tenant.rst
View File

@ -10,8 +10,44 @@ Modify a MinIO Tenant
:local:
:depth: 1
The procedures on this page use the :ref:`MinIO Operator Console <minio-operator-console>` for modifying an existing tenant.
Stub: TODO
.. image:: /images/k8s/operator-manage-tenant.png
:align: center
:width: 70%
:class: no-scaled-link
:alt: MinIO Operator Tenant Console
.. _minio-k8s-modify-minio-tenant-security:
Modify Tenant TLS Configuration
-------------------------------
The MinIO Operator Console supports adding and removing TLS certificates from a MinIO Tenant.
From the Operator Console view, select the Tenant to open the summary view, then select :guilabel:`Security`.
You can make the following modifications:
Enable or Disable TLS
Toggle the :guilabel:`TLS` switch to direct the Operator to either enable or disable TLS for the deployment.
The MinIO Operator automatically generates the necessary TLS certificates using the Kubernetes TLS API.
See :ref:`minio-tls-user-generated` for more information.
Add Custom TLS Certificates
MinIO Tenants support `Server Name Indication (SNI) <https://en.wikipedia.org/wiki/Server_Name_Indication>`__, where the MinIO server identifies which certificate to use based on the hostname specified by the connecting client.
The MinIO Operator can attach additional TLS certificates to the Tenant to enable SNI-based TLS connectivity.
To customize the TLS certificates mounted on the MinIO Tenant, enable the :guilabel:`Custom Certificates` switch.
Select the :guilabel:`Add Certificate +` button to add custom TLS certificates.
Add Trusted Certificate Authorities
The MinIO Tenant validates the TLS certificate presented by each connecting client against the host system's trusted root certificate store.
The MinIO Operator can attach additional third-party Certificate Authorities (CA) to the Tenant to allow validation of client TLS certificates signed by those CAs.
To customize the trusted CAs mounted to each Tenant MinIO pod, enable the :guilabel:`Custom Certificates` switch.
Select the :guilabel:`Add CA Certificate +` button to add third party CA certificates.
If the MinIO Tenant cannot match an incoming client's TLS certificate issuer against either the container OS's trust store *or* an explicitly attached CA, MinIO rejects the connection as invalid.
.. Following link is intended for K8s only
.. _minio-decommissioning: