DOCS-845: Updates for MinIO Server RELEASE.2023-05-04T21-44-30Z (#852)

Closes #845 

Staged: http://192.241.195.202:9000/staging/DOCS-845/linux/index.html

source/administration/batch-framework.rst

@@ -87,11 +87,16 @@ Job Types
 Replicate
 ~~~~~~~~~
 
-Use the ``replicate`` job type to create a batch job that replicates objects from one MinIO deployment to another MinIO location.
+Use the ``replicate`` job type to create a batch job that replicates objects from one MinIO deployment to another MinIO target.
+
+.. versionadded:: MinIO Server RELEASE.2023-05-04T21-44-30Z
+
+   ``replicate`` batch jobs also support :mc:`mc mirror`-like behavior when presented an S3-compatible source or target.
+
 At least one of the deployment locations, either the source or the target, must be ``local``.
 The definition file can limit the replication by bucket, prefix, and/or filters to only replicate certain objects.
 
-.. versionchanged:: MinIO RELEASE.2023-04-07T05-28-58Z
+.. versionchanged:: MinIO Server RELEASE.2023-04-07T05-28-58Z
 
    You can replicate from a remote MinIO deployment to the local deployment that runs the batch job.
 
@@ -104,8 +109,9 @@ The advantages of Batch Replication over :mc:`mc mirror` include:
 - A user only needs access to starting a batch job with no other permissions, as the job runs entirely server side on the cluster
 - The job provides for retry attempts in event that objects do not replicate
 - Batch jobs are one-time, curated processes allowing for fine control replication
+- (MinIO to MinIO only) The replication process copies object versions from source to target
 
-.. versionchanged:: RELEASE.2023-02-17T17-52-43Z
+.. versionchanged:: MinIO Server RELEASE.2023-02-17T17-52-43Z
 
    Run batch replication with multiple workers in parallel by specifying the :envvar:`MINIO_BATCH_REPLICATION_WORKERS` environment variable.
 

source/administration/object-management/object-versioning.rst

@@ -63,7 +63,15 @@ explicitly choose to list, retrieve, or remove a specific object version.
 
 :ref:`Deleting <minio-bucket-versioning-delete>` an object results in a special
 ``DeleteMarker`` tombstone that marks an object as deleted while retaining
-all previous versions of that object.
+all previous versions of that object.   
+
+.. versionchanged:: MinIO Server RELEASE.2023-05-04T21-44-30Z
+
+   MinIO does not create versions for creation, mutation, or deletion of explicit directory objects ("prefixes").
+   Objects created within that explicit directory object retain normal versioning behavior.
+
+MinIO implicitly determines prefixes from object paths.
+Explicit prefix creation typically only occurs with Spark and similar workloads which apply legacy POSIX/HDFS directory creation behavior within the S3 context.
 
 Versioning is Per-Namespace
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~

source/includes/code/replicate.yaml

@@ -2,7 +2,7 @@ replicate:
   apiVersion: v1
   # source of the objects to be replicated
   source:
-    type: TYPE # valid values are "s3"
+    type: TYPE # valid values are "s3" or "minio"
     bucket: BUCKET
     prefix: PREFIX
     # endpoint: ENDPOINT
@@ -13,7 +13,7 @@ replicate:
 
   # target where the objects must be replicated
   target:
-    type: TYPE # valid values are "s3"
+    type: TYPE # valid values are "s3" or "minio"
     bucket: BUCKET
     prefix: PREFIX
     # endpoint: ENDPOINT

source/includes/common-mc-admin-config.rst

@@ -1007,3 +1007,18 @@ Specify the maximum limit for undelivered messages. Defaults to ``100000``.
 Specify a comment to associate with the Webhook configuration.
 
 .. end-minio-notify-webhook-comment
+
+.. Root API Access
+
+.. start-minio-root-api-access
+
+.. versionadded:: MinIO Server RELEASE.2023-05-04T21-44-30Z
+
+Specify ``on`` to enable and ``off`` to disable the :ref:`root <minio-users-root>` user account.
+Disabling the root service account also disables all service accounts associated with root, excluding those used by site replication.
+Defaults to ``on``.
+
+Ensure you have at least one other admin user, such as one with the :userpolicy:`consoleAdmin` policy, before disabling the root account.
+If you do not have another admin user, disabling the root account locks administrative access to the deployment.
+
+.. end-minio-root-api-access

source/includes/linux/common-installation.rst

@@ -233,6 +233,11 @@ file manually on all MinIO hosts:
    ExecStartPre=/bin/bash -c "if [ -z \"${MINIO_VOLUMES}\" ]; then echo \"Variable MINIO_VOLUMES not set in /etc/default/minio\"; exit 1; fi"
    ExecStart=/usr/local/bin/minio server $MINIO_OPTS $MINIO_VOLUMES
 
+   # MinIO RELEASE.2023-05-04T21-44-30Z adds support for Type=notify (https://www.freedesktop.org/software/systemd/man/systemd.service.html#Type=)
+   # This may improve systemctl setups where other services use `After=minio.server`
+   # Uncomment the line to enable the functionality
+   # Type=notify
+
    # Let systemd restart this service always
    Restart=always
 

source/operations/monitoring/metrics-and-alerts.rst

@@ -286,6 +286,18 @@ Node and Drive Health Metrics
    Time elapsed (in nano seconds) since last self healing activity. This is set
    to -1 until initial self heal
 
+.. metric:: minio_node_storage_class_standard_parity
+
+   The configured value of :envvar:`MINIO_STORAGE_CLASS_STANDARD`.
+
+   Use this to alert for changes to the Standard :ref:`erasure parity <minio-erasure-coding>`.
+
+.. metric:: minio_node_storage_class_rrs_parity
+
+   The configured value of :envvar:`MINIO_STORAGE_CLASS_RRS`.
+
+   Use this to alert for changes to the Reduced :ref:`erasure parity <minio-erasure-coding>`.
+
 Notification Queue Metrics
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 

source/reference/minio-mc-admin/mc-admin-config.rst

@@ -88,6 +88,24 @@ Configuration Settings
 The following configuration settings define runtime behavior of the 
 MinIO :mc:`server <minio server>` process:
 
+Root User Account
+~~~~~~~~~~~~~~~~~
+
+.. mc-conf:: api
+
+   The top-level configuration key for modifying API-related operations.
+
+   .. mc-conf:: root_access
+
+      .. include:: /includes/common-mc-admin-config.rst
+         :start-after: start-minio-root-api-access
+         :end-before: end-minio-root-api-access
+
+      This configuration setting corresponds with the :envvar:`MINIO_API_ROOT_ACCESS` environment variable.
+      To reset after an unintentional lock, set :envvar:`MINIO_API_ROOT_ACCESS` ``on`` to override this setting and temporarily re-enable the root account.
+      You can then change this setting to ``on`` *or* make the necessary user/policy changes to ensure normal administrative access through other non-root accounts.
+
+
 .. _minio-server-config-logging-logs:
 
 HTTP Webhook Log Target

source/reference/minio-server/minio-server.rst

@@ -312,6 +312,15 @@ Root Credentials
       MinIO strongly recommends specifying a unique, long, and random
       :envvar:`MINIO_ROOT_PASSWORD` value for all environments.
 
+.. envvar:: MINIO_API_ROOT_ACCESS
+
+   .. include:: /includes/common-mc-admin-config.rst
+      :start-after: start-minio-root-api-access
+      :end-before: end-minio-root-api-access
+
+   This variable corresponds to the :mc-conf:`api root_access <api.root_access>` configuration setting.
+   You can use this variable to temporarily override the configuration setting and re-enable root access to the deployment.
+
 .. envvar:: MINIO_ACCESS_KEY
 
    .. deprecated:: RELEASE.2021-04-22T15-44-28Z
@@ -410,18 +419,14 @@ MinIO Console:
 
    Specify ``off`` to disable the embedded MinIO Console.
 
-.. envvar:: MINIO_SERVER_URL
+.. envvar:: MINIO_BROWSER_LOGIN_ANIMATION
 
    *Optional*
 
-   Specify the URL hostname the MinIO Console should use for connecting to the
-   MinIO Server.
+   .. versionadded:: MinIO Server RELEASE.2023-05-04T21-44-30Z
 
-   This variable may be necessary if the MinIO Server TLS certificates do 
-   not contain any IP Subject Alternative Names (SAN). Specifically, the
-   Console uses the MinIO Server IP address by default. If the Server TLS does
-   not contain that IP address, then the Console cannot validate the TLS
-   connection.
+   Specify ``off`` to disable the animated login screen for the MinIO Console. 
+   Defaults to ``on``.
 
 .. envvar:: MINIO_BROWSER_REDIRECT_URL
 
@@ -445,6 +450,15 @@ MinIO Console:
    the external identity provider has a reachable URL to which to send the
    authentication response.
 
+.. envvar:: MINIO_SERVER_URL
+
+   *Optional*
+
+   Specify the Fully Qualified Domain Name (FQDN) the MinIO Console should use for connecting to the MinIO Server.
+
+   This variable is typically only necessary when the MinIO Server TLS certificates do not contain an IP Subject Alternative Name (SAN) for the MinIO Server.
+   Since the Console uses the MinIO Server IP by default, the Console may fail to connect due to the TLS certificate not having the necessary IP listed as a SAN.
+
 Key Management Service and Encryption
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -522,6 +536,16 @@ refers to the specific storage tier on which to store a given object.
    This environment variable only applies to deployments with
    :ref:`Erasure Coding <minio-erasure-coding>` enabled.
 
+   The minimum value at startup is ``0``.
+   0 parity setups have no erasure coding protections and rely entirely on the storage controller or resource for availability / resiliency. 
+
+   The maximum value is 1/2 the erasure set stripe size.
+   For example, a deployment with erasure set stripe size of 16 has a maximum standard parity of 8.
+
+   You can change the Standard parity after startup to a value between ``1`` and :math:`\tfrac{1}{2}\ (ERASURE_SET_SIZE)`.
+   MinIO only applies the changed parity to newly written objects.
+   Existing objects retain the parity value in place at the time of their creation.
+
    Defaults to ``4``.
 
 .. envvar:: MINIO_STORAGE_CLASS_RRS