mirror of
https://github.com/minio/docs.git
synced 2025-07-30 07:03:26 +03:00
attempt to remove plugin from docs (#1219)
The Kubernetes plugin is gone, this PR replaces the procedures that use `kubectl minio` in all its various forms. The plugin was referenced on many pages and for many purposes so there is _a lot_ of restructuring involved. Some procedures no longer have CLI instructions, which can be addressed in subsequent PRs. Everything should have at least one working method, even if it's to use Operator Console. - Remove references to plugin, except for pre-4.5.8 upgrade paths - Move pre-4.5.8 upgrade paths to new child page (currently hidden from TOC, linked in page) - Fill in with new Kustomize, kubectl, and/or Operator Console steps. A handful of old screen captures still to be updated Staged: - [Operator deploy](http://192.241.195.202:9000/staging/DOCS-1213-upstream/k8s/operations/installation.html) - [Operator upgrade](http://192.241.195.202:9000/staging/DOCS-1213-upstream/k8s/operations/install-deploy-manage/upgrade-minio-operator.html) - [Deploy and manage Tenants](http://192.241.195.202:9000/staging/DOCS-1213-upstream/k8s/operations/deploy-manage-tenants.html) Fixes https://github.com/minio/docs/issues/1213
This commit is contained in:
Andrea Longo
GitHub
@ -1,3 +1,4 @@
|
||||
|
||||
.. _deploy-operator-gke:
|
||||
|
||||
=================================================
|
||||
@ -20,11 +21,7 @@ The MinIO Kubernetes Operator supports deploying MinIO Tenants onto AKS infrastr
|
||||
MinIO maintains an `AKS Marketplace listing <https://azuremarketplace.microsoft.com/en-us/marketplace/apps/minio.minio-object-storage_v1dot1>`__ through which you can register your AKS cluster with |subnet|.
|
||||
Any MinIO tenant you deploy through Marketplace-connected clusters can take advantage of SUBNET registration, including 24/7 access to MinIO engineers.
|
||||
|
||||
Using the MinIO ``kubectl`` Plugin
|
||||
MinIO provides a ``kubectl`` plugin for installing and managing the MinIO Operator and Tenants through a terminal or shell (CLI) environment.
|
||||
You can manually register these tenants with |subnet| at any time.
|
||||
|
||||
This page documents deploying the MinIO Operator through the CLI using the ``kubectl minio`` plugin.
|
||||
This page documents deploying the MinIO Operator through the CLI using Kustomize.
|
||||
For instructions on deploying the MinIO Operator through the AKS Marketplace, see :minio-web:`Deploy MinIO through AKS <multicloud-azure-kubernetes-service/deploy>`
|
||||
|
||||
This documentation assumes familiarity with all referenced Kubernetes and Azure Kubernetes Service concepts, utilities, and procedures.
|
||||
@ -51,5 +48,6 @@ For guidance on connecting ``kubectl`` to AKS, see :aks-docs:`Install kubectl an
|
||||
Procedure
|
||||
---------
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kubectl-plugin.rst
|
||||
The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kustomize.rst
|
||||
|
||||
@ -1,81 +0,0 @@
|
||||
1) Install the MinIO Kubernetes Plugin
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The MinIO Kubernetes Plugin provides a command for initializing the MinIO Operator.
|
||||
|
||||
.. include:: /includes/k8s/install-minio-kubectl-plugin.rst
|
||||
|
||||
2) Initialize the MinIO Kubernetes Operator
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Run the :mc:`kubectl minio init` command to initialize the MinIO Operator:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio init
|
||||
|
||||
The command initializes the MinIO Operator with the following default settings:
|
||||
|
||||
- Deploy the Operator into the ``minio-operator`` namespace.
|
||||
Specify the :mc-cmd:`kubectl minio init --namespace` argument to
|
||||
deploy the operator into a different namespace.
|
||||
|
||||
- Use ``cluster.local`` as the cluster domain when configuring the DNS hostname
|
||||
of the operator. Specify the
|
||||
:mc-cmd:`kubectl minio init --cluster-domain` argument to set a
|
||||
different :kube-docs:`cluster domain
|
||||
<tasks/administer-cluster/dns-custom-nameservers/>` value.
|
||||
|
||||
|
||||
The Operator deploys with certain default settings and resource requests.
|
||||
To modify these settings, do the following:
|
||||
|
||||
1. Append the ``kubectl minio init -o > operator.yaml`` to save the YAML configuration to file
|
||||
2. Modify settings as-needed to fit your deployment
|
||||
3. Run ``kubectl apply -f operator.yaml`` to apply the customized Operator deployment.
|
||||
|
||||
.. important::
|
||||
|
||||
Document all arguments used when initializing the MinIO Operator.
|
||||
|
||||
3) Validate the Operator Installation
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
To verify the installation, run the following command:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get all --namespace minio-operator
|
||||
|
||||
If you initialized the Operator with a custom namespace, replace
|
||||
``minio-operator`` with that namespace.
|
||||
|
||||
The output resembles the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
pod/console-59b769c486-cv7zv 1/1 Running 0 81m
|
||||
pod/minio-operator-7976b4df5b-rsskl 1/1 Running 0 81m
|
||||
|
||||
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
service/console ClusterIP 10.105.218.94 <none> 9090/TCP,9443/TCP 81m
|
||||
service/operator ClusterIP 10.110.113.146 <none> 4222/TCP,4233/TCP 81m
|
||||
|
||||
NAME READY UP-TO-DATE AVAILABLE AGE
|
||||
deployment.apps/console 1/1 1 1 81m
|
||||
deployment.apps/minio-operator 1/1 1 1 81m
|
||||
|
||||
NAME DESIRED CURRENT READY AGE
|
||||
replicaset.apps/console-59b769c486 1 1 1 81m
|
||||
replicaset.apps/minio-operator-7976b4df5b 1 1 1 81m
|
||||
|
||||
4) Open the Operator Console
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-k8s-connect-operator-console.rst
|
||||
|
||||
|
||||
|
||||
195
source/includes/common/common-install-operator-kustomize.rst
Normal file
195
source/includes/common/common-install-operator-kustomize.rst
Normal file
@ -0,0 +1,195 @@
|
||||
.. _minio-k8s-deploy-operator-kustomize-repo-2:
|
||||
|
||||
Install the MinIO Operator using Kustomize
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The following procedure uses ``kubectl -k`` to install the Operator from the MinIO Operator GitHub repository.
|
||||
``kubectl -k`` and ``kubectl --kustomize`` are aliases that perform the same command.
|
||||
|
||||
.. important::
|
||||
|
||||
If you use Kustomize to install the Operator, you must use Kustomize to manage or upgrade that installation.
|
||||
Do not use ``kubectl krew``, a Helm chart, or similar methods to manage or upgrade a MinIO Operator installation deployed with Kustomize.
|
||||
|
||||
You can, however, use Kustomize to upgrade a previous version of Operator (5.0.14 or earlier) installed with the MinIO Kubernetes Plugin.
|
||||
|
||||
#. Install the latest version of Operator
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kubectl apply -k "github.com/minio/operator?ref=v|operator-version-stable|"
|
||||
|
||||
The output resembles the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
namespace/minio-operator created
|
||||
customresourcedefinition.apiextensions.k8s.io/miniojobs.job.min.io created
|
||||
customresourcedefinition.apiextensions.k8s.io/policybindings.sts.min.io created
|
||||
customresourcedefinition.apiextensions.k8s.io/tenants.minio.min.io created
|
||||
serviceaccount/console-sa created
|
||||
serviceaccount/minio-operator created
|
||||
clusterrole.rbac.authorization.k8s.io/console-sa-role created
|
||||
clusterrole.rbac.authorization.k8s.io/minio-operator-role created
|
||||
clusterrolebinding.rbac.authorization.k8s.io/console-sa-binding created
|
||||
clusterrolebinding.rbac.authorization.k8s.io/minio-operator-binding created
|
||||
configmap/console-env created
|
||||
secret/console-sa-secret created
|
||||
service/console created
|
||||
service/operator created
|
||||
service/sts created
|
||||
deployment.apps/console created
|
||||
deployment.apps/minio-operator created
|
||||
|
||||
#. Verify the Operator pods are running:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get pods -n minio-operator
|
||||
|
||||
The output resembles the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
console-56c7d8bd89-485qh 1/1 Running 0 2m42s
|
||||
minio-operator-6c758b8c45-nkhlx 1/1 Running 0 2m42s
|
||||
minio-operator-6c758b8c45-dgd8n 1/1 Running 0 2m42s
|
||||
|
||||
In this example, the ``minio-operator`` pod is MinIO Operator and the ``console`` pod is the Operator Console.
|
||||
|
||||
You can modify your Operator deployment by applying kubectl patches.
|
||||
You can find examples for common configurations in the `Operator GitHub repository <https://github.com/minio/operator/tree/master/examples/kustomization>`__.
|
||||
|
||||
.. _minio-k8s-deploy-operator-access-console:
|
||||
|
||||
#. *(Optional)* Configure access to the Operator Console service
|
||||
|
||||
The Operator Console service does not automatically bind or expose itself for external access on the Kubernetes cluster.
|
||||
You must instead configure a network control plane component, such as a load balancer or ingress, to grant that external access.
|
||||
|
||||
For testing purposes or short-term access, expose the Operator Console service through a NodePort using the following patch:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl patch service -n minio-operator console -p '
|
||||
{
|
||||
"spec": {
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 9090,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9090,
|
||||
"nodePort": 30090
|
||||
},
|
||||
{
|
||||
"name": "https",
|
||||
"port": 9443,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9443,
|
||||
"nodePort": 30433
|
||||
}
|
||||
],
|
||||
"type": "NodePort"
|
||||
}
|
||||
}'
|
||||
|
||||
The patch command should output ``service/console patched``.
|
||||
You can now access the service through ports ``30433`` (HTTPS) or ``30090`` (HTTP) on any of your Kubernetes worker nodes.
|
||||
|
||||
#. Verify the Operator installation
|
||||
|
||||
Check the contents of the specified namespace (``minio-operator``) to ensure all pods and services have started successfully.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get all -n minio-operator
|
||||
|
||||
The response should resemble the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
pod/console-56c7d8bd89-485qh 1/1 Running 0 5m20s
|
||||
pod/minio-operator-6c758b8c45-nkhlx 1/1 Running 0 5m20s
|
||||
pod/minio-operator-6c758b8c45-dgd8n 1/1 Running 0 5m20s
|
||||
|
||||
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
service/operator ClusterIP 10.43.135.241 <none> 4221/TCP 5m20s
|
||||
service/sts ClusterIP 10.43.117.251 <none> 4223/TCP 5m20s
|
||||
service/console NodePort 10.43.235.38 <none> 9090:30090/TCP,9443:30433/TCP 5m20s
|
||||
|
||||
NAME READY UP-TO-DATE AVAILABLE AGE
|
||||
deployment.apps/console 1/1 1 1 5m20s
|
||||
deployment.apps/minio-operator 2/2 2 2 5m20s
|
||||
|
||||
NAME DESIRED CURRENT READY AGE
|
||||
replicaset.apps/console-56c7d8bd89 1 1 1 5m20s
|
||||
replicaset.apps/minio-operator-6c758b8c45 2 2 2 5m20s
|
||||
|
||||
#. Retrieve the Operator Console JWT for login
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl apply -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: console-sa-secret
|
||||
namespace: minio-operator
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: console-sa
|
||||
type: kubernetes.io/service-account-token
|
||||
EOF
|
||||
SA_TOKEN=$(kubectl -n minio-operator get secret console-sa-secret -o jsonpath="{.data.token}" | base64 --decode)
|
||||
echo $SA_TOKEN
|
||||
|
||||
The output of this command is the JSON Web Token (JWT) login credential for Operator Console.
|
||||
|
||||
#. Log into the MinIO Operator Console
|
||||
|
||||
|
||||
.. tab-set::
|
||||
|
||||
.. tab-item:: NodePort
|
||||
:selected:
|
||||
|
||||
If you configured the service for access through a NodePort, specify the hostname of any worker node in the cluster with that port as ``HOSTNAME:NODEPORT`` to access the Console.
|
||||
|
||||
For example, a deployment configured with a NodePort of 30090 and the following ``InternalIP`` addresses can be accessed at ``http://172.18.0.5:30090``.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get nodes -o custom-columns=IP:.status.addresses[:]
|
||||
IP
|
||||
map[address:172.18.0.5 type:InternalIP],map[address:k3d-MINIO-agent-3 type:Hostname]
|
||||
map[address:172.18.0.6 type:InternalIP],map[address:k3d-MINIO-agent-2 type:Hostname]
|
||||
map[address:172.18.0.2 type:InternalIP],map[address:k3d-MINIO-server-0 type:Hostname]
|
||||
map[address:172.18.0.4 type:InternalIP],map[address:k3d-MINIO-agent-1 type:Hostname]
|
||||
map[address:172.18.0.3 type:InternalIP],map[address:k3d-MINIO-agent-0 type:Hostname]
|
||||
|
||||
.. tab-item:: Ingress or Load Balancer
|
||||
|
||||
If you configured the ``svc/console`` service for access through ingress or a cluster load balancer, you can access the Console using the configured hostname and port.
|
||||
|
||||
.. tab-item:: Port Forwarding
|
||||
|
||||
You can use ``kubectl port forward`` to temporary forward ports for the Console:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl port-forward svc/console -n minio-operator 9090:9090
|
||||
|
||||
You can then use ``http://localhost:9090`` to access the MinIO Operator Console.
|
||||
|
||||
Once you access the Console, use the Console JWT to log in.
|
||||
You can now :ref:`deploy and manage MinIO Tenants using the Operator Console <deploy-minio-distributed>`.
|
||||
@ -0,0 +1,37 @@
|
||||
The Operator Console service does not automatically bind or expose itself for external access on the Kubernetes cluster.
|
||||
Instead, you must configure a network control plane component, such as a load balancer or ingress, to grant external access.
|
||||
|
||||
.. cond:: k8s
|
||||
|
||||
For testing purposes or short-term access, expose the Operator Console service through a NodePort using the following patch:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl patch service -n minio-operator console -p '
|
||||
{
|
||||
"spec": {
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 9090,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9090,
|
||||
"nodePort": 30090
|
||||
},
|
||||
{
|
||||
"name": "https",
|
||||
"port": 9443,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9443,
|
||||
"nodePort": 30433
|
||||
}
|
||||
],
|
||||
"type": "NodePort"
|
||||
}
|
||||
}'
|
||||
|
||||
After applying the path, you can access the service through port ``30433`` on any of the Kubernetes worker nodes.
|
||||
|
||||
Append the ``nodePort`` value to the externally-accessible IP address of a worker node in your Kubernetes cluster.
|
||||
Use the appropriate ``http`` or ``https`` port depending on whether you deployed Operator Console with TLS.
|
||||
@ -1,77 +1,60 @@
|
||||
.. dropdown:: Port Forwarding
|
||||
:open:
|
||||
|
||||
.. note::
|
||||
|
||||
Some Kubernetes deployments may experience issues with timeouts during port-forwarding operations with the Operator Console.
|
||||
Select the :guilabel:`NodePorts` section to view instructions for alternative access.
|
||||
You can alternatively configure your preferred Ingress to grant access to the Operator Console service.
|
||||
See https://github.com/kubernetes/kubectl/issues/1368 for more information.
|
||||
|
||||
Run the :mc:`kubectl minio proxy` command to temporarily forward traffic from the :ref:`MinIO Operator Console <minio-operator-console>` service to your local machine:
|
||||
The :ref:`Operator Console service <minio-operator-console>` does not automatically bind or expose itself for external access on the Kubernetes cluster.
|
||||
Instead, configure a network control plane component, such as a load balancer or ingress, to grant external access.
|
||||
|
||||
.. cond:: k8s and not openshift
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio proxy
|
||||
|
||||
.. cond:: openshift
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
oc minio proxy
|
||||
|
||||
The command output includes a required token for logging into the Operator Console.
|
||||
|
||||
.. image:: /images/k8s/operator-dashboard.png
|
||||
:align: center
|
||||
:width: 70%
|
||||
:class: no-scaled-link
|
||||
:alt: MinIO Operator Console
|
||||
|
||||
You can deploy a new :ref:`MinIO Tenant <minio-k8s-deploy-minio-tenant>` from the Operator Dashboard.
|
||||
|
||||
.. dropdown:: NodePorts
|
||||
|
||||
Use the following command to identify the :kube-docs:`NodePorts <concepts/services-networking/service/#type-nodeport>` configured for the Operator Console.
|
||||
If your local host does not have the ``jq`` utility installed, you can run the first command and locate the ``spec.ports`` section of the output.
|
||||
For testing purposes or short-term access, expose the Operator Console service through a NodePort using the following patch:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get svc/console -n minio-operator -o json | jq -r '.spec.ports'
|
||||
kubectl patch service -n minio-operator console -p '
|
||||
{
|
||||
"spec": {
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 9090,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9090,
|
||||
"nodePort": 30090
|
||||
},
|
||||
{
|
||||
"name": "https",
|
||||
"port": 9443,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9443,
|
||||
"nodePort": 30433
|
||||
}
|
||||
],
|
||||
"type": "NodePort"
|
||||
}
|
||||
}'
|
||||
|
||||
The output resembles the following:
|
||||
The patch command should output ``service/console patched``.
|
||||
You can now access the service through ports ``30433`` (HTTPS) or ``30090`` (HTTP) on any of your Kubernetes worker nodes.
|
||||
|
||||
.. code-block:: json
|
||||
For example, a Kubernetes cluster with the following Operator nodes might be accessed at ``https://172.18.0.2:30443``:
|
||||
|
||||
[
|
||||
{
|
||||
"name": "http",
|
||||
"nodePort": 31055,
|
||||
"port": 9090,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9090
|
||||
},
|
||||
{
|
||||
"name": "https",
|
||||
"nodePort": 31388,
|
||||
"port": 9443,
|
||||
"protocol": "TCP",
|
||||
"targetPort": 9443
|
||||
}
|
||||
]
|
||||
.. code-block:: shell
|
||||
|
||||
Use the ``http`` or ``https`` port depending on whether you deployed the Operator with Console TLS enabled via :mc-cmd:`kubectl minio init --console-tls`.
|
||||
|
||||
Append the ``nodePort`` value to the externally-accessible IP address of a worker node in your Kubernetes cluster.
|
||||
kubectl get nodes -o custom-columns=IP:.status.addresses[:]
|
||||
IP
|
||||
map[address:172.18.0.5 type:InternalIP],map[address:k3d-MINIO-agent-3 type:Hostname]
|
||||
map[address:172.18.0.6 type:InternalIP],map[address:k3d-MINIO-agent-2 type:Hostname]
|
||||
map[address:172.18.0.2 type:InternalIP],map[address:k3d-MINIO-server-0 type:Hostname]
|
||||
map[address:172.18.0.4 type:InternalIP],map[address:k3d-MINIO-agent-1 type:Hostname]
|
||||
map[address:172.18.0.3 type:InternalIP],map[address:k3d-MINIO-agent-0 type:Hostname]
|
||||
|
||||
Use the following command to retrieve the JWT token necessary for logging into the Operator Console:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get secret/console-sa-secret -n minio-operator -o json | jq -r '.data.token' | base64 -d
|
||||
kubectl get secret/console-sa-secret -n minio-operator -o json | jq -r '.data.token' | base64 -d
|
||||
|
||||
If your local host does not have the ``jq`` utility installed, you can run the ``kubectl`` part of this command (before ``| jq``) and locate the ``data.token`` section of the output.
|
||||
|
||||
|
||||
@ -0,0 +1,8 @@
|
||||
Use the following command to retrieve the JSON Web Token (JWT) necessary for logging in to the Operator Console:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get secret/console-sa-secret -n minio-operator -o json | jq -r '.data.token' | base64 -d
|
||||
|
||||
If your local host does not have the ``jq`` utility installed, you can run the ``kubectl`` part of this command (before ``| jq``) and locate the ``data.token`` section of the output.
|
||||
@ -1,7 +1,7 @@
|
||||
.. start-kes-configuration-hashicorp-vault-desc
|
||||
|
||||
|KES| uses a YAML-formatted configuration file.
|
||||
The following YAML provides the minimum required fields for using Hashicorp Vault as the root |KMS|.
|
||||
The following YAML provides the minimum required fields for using HashiCorp Vault as the root |KMS|.
|
||||
You must modify this YAML to reflect your deployment environment.
|
||||
|
||||
.. code-block:: shell
|
||||
@ -54,8 +54,8 @@ You must modify this YAML to reflect your deployment environment.
|
||||
engine: "/path/to/engine" # Replace with the path to the K/V Engine
|
||||
version: "v1|v2" # Specify v1 or v2 depending on the version of the K/V Engine
|
||||
approle:
|
||||
id: "VAULTAPPID" # Hashicorp Vault AppRole ID
|
||||
secret: "VAULTAPPSECRET" # Hashicorp Vault AppRole Secret ID
|
||||
id: "VAULTAPPID" # HashiCorp Vault AppRole ID
|
||||
secret: "VAULTAPPSECRET" # HashiCorp Vault AppRole Secret ID
|
||||
retry: 15s
|
||||
status:
|
||||
ping: 10s
|
||||
@ -70,7 +70,7 @@ You must modify this YAML to reflect your deployment environment.
|
||||
|
||||
.. start-kes-prereq-hashicorp-vault-desc
|
||||
|
||||
This procedure assumes an existing `Hashicorp Vault <https://www.vaultproject.io/>`__ installation accessible from the local host.
|
||||
This procedure assumes an existing `HashiCorp Vault <https://www.vaultproject.io/>`__ installation accessible from the local host.
|
||||
The Vault `Quick Start <https://learn.hashicorp.com/tutorials/vault/getting-started-install>`__ provides a sufficient foundation for the purposes of this procedure.
|
||||
Defer to the `Vault Documentation <https://learn.hashicorp.com/vault>`__ for guidance on deployment and configuration.
|
||||
|
||||
@ -95,4 +95,4 @@ Defer to the `Vault Documentation <https://learn.hashicorp.com/vault>`__ for gui
|
||||
You must unseal the Vault instance to allow normal cryptographic operations, including key creation or retrieval.
|
||||
See the Vault documentation on `Seal/Unseal <https://www.vaultproject.io/docs/concepts/seal>`__ for more information.
|
||||
|
||||
.. end-kes-vault-seal-unseal-desc
|
||||
.. end-kes-vault-seal-unseal-desc
|
||||
|
||||
@ -89,7 +89,7 @@ The following table describes each line of the command and provides additional c
|
||||
Replace this value with the full path to a storage volume or folder on the local machine.
|
||||
For example:
|
||||
|
||||
Linux or MacOS
|
||||
Linux or macOS
|
||||
``~/minio/data/``
|
||||
|
||||
Windows
|
||||
|
||||
@ -22,11 +22,7 @@ MinIO supports the following methods for installing the MinIO Operator onto your
|
||||
MinIO maintains an `AWS Marketplace listing <https://aws.amazon.com/marketplace/pp/prodview-smchi7bcs4nn4>`__ through which you can register your EKS cluster with |subnet|.
|
||||
Any tenant you deploy through Marketplace-connected clusters can take advantage of SUBNET registration, including 24/7 direct access to MinIO engineers.
|
||||
|
||||
Using the MinIO ``kubectl`` Plugin
|
||||
MinIO provides a ``kubectl`` plugin for installing and managing the MinIO Operator and Tenants through a terminal or shell (CLI) environment.
|
||||
You can manually register these tenants with |subnet| at any time.
|
||||
|
||||
This page documents deploying the MinIO Operator through the CLI using the ``kubectl minio`` plugin.
|
||||
This page documents deploying the MinIO Operator through the CLI using Kustomize.
|
||||
For instructions on deploying the MinIO Operator through the AWS Marketplace, see :minio-web:`Deploy MinIO through EKS <product/multicloud-elastic-kubernetes-service/deploy>`
|
||||
|
||||
This documentation assumes familiarity with all referenced Kubernetes and Elastic Kubernetes Service concepts, utilities, and procedures.
|
||||
@ -57,4 +53,6 @@ You can use this policy as a baseline for manual Operator installations.
|
||||
Procedure
|
||||
---------
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kubectl-plugin.rst
|
||||
The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kustomize.rst
|
||||
|
||||
@ -1,20 +0,0 @@
|
||||
.. default-domain:: minio
|
||||
|
||||
.. start-kubectl-minio-requires-operator-desc
|
||||
|
||||
.. admonition:: Command Requires MinIO Operator
|
||||
:class: note
|
||||
|
||||
Use the following command to validate that the operator
|
||||
is online and available prior to running this command:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get deployments -A --field-selector metadata.name=minio-operator
|
||||
|
||||
Issue the :mc-cmd:`kubectl minio init` command to initiate the operator
|
||||
if it is not already running in the Kubernetes cluster.
|
||||
|
||||
|
||||
.. end-kubectl-minio-requires-operator-desc
|
||||
@ -24,7 +24,7 @@ Using the MinIO ``kubectl`` Plugin
|
||||
MinIO provides a ``kubectl`` plugin for installing and managing the MinIO Operator and Tenants through a terminal or shell (CLI) environment.
|
||||
You can manually register these tenants with |subnet| at any time.
|
||||
|
||||
This page documents deploying the MinIO Operator through the CLI using the ``kubectl minio`` plugin.
|
||||
This page documents deploying the MinIO Operator through the CLI using Kustomize.
|
||||
For instructions on deploying the MinIO Operator through the GKE Marketplace, see :minio-web:`Deploy MinIO through GKE <product/multicloud-google-kubernetes-service/deploy>`
|
||||
|
||||
This documentation assumes familiarity with all referenced Kubernetes and Google Kubernetes Engine concepts, utilities, and procedures.
|
||||
@ -51,4 +51,6 @@ For guidance on connecting ``kubectl`` to GKE, see :gke-docs:`Install kubectl an
|
||||
Procedure
|
||||
---------
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kubectl-plugin.rst
|
||||
The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kustomize.rst
|
||||
|
||||
@ -1,9 +1,7 @@
|
||||
.. start-requires-operator-plugin
|
||||
|
||||
Ensure your target Kubernetes cluster has a valid and working installation of the MinIO Kubernetes Operator.
|
||||
The host machine from which you perform the procedure should have a matching installation of the MinIO Kubernetes Plugin
|
||||
|
||||
This documentation assumes the latest stable Operator and Plugin version |operator-version-stable|.
|
||||
This documentation assumes the latest stable Operator, version |operator-version-stable|.
|
||||
|
||||
.. end-requires-operator-plugin
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
.. _minio-operator-installation:
|
||||
.. _deploy-operator-kubernetes:
|
||||
.. _minio-operator-installation-kustomize:
|
||||
.. _deploy-operator-kubernetes-kustomize:
|
||||
|
||||
=========================
|
||||
Deploy the MinIO Operator
|
||||
@ -17,22 +17,21 @@ Overview
|
||||
MinIO is a Kubernetes-native high performance object store with an S3-compatible API.
|
||||
The MinIO Kubernetes Operator supports deploying MinIO Tenants onto private and public cloud infrastructures ("Hybrid" Cloud).
|
||||
|
||||
The following procedure installs the latest stable version (|operator-version-stable|) of the MinIO Operator and MinIO Plugin on Kubernetes infrastructure:
|
||||
The following procedure installs the latest stable version (|operator-version-stable|) of the MinIO Operator on Kubernetes infrastructure.
|
||||
|
||||
- The MinIO Operator installs a :kube-docs:`Custom Resource Definition (CRD) <concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions>` to support describing MinIO tenants as a Kubernetes :kube-docs:`object <concepts/overview/working-with-objects/kubernetes-objects/>`.
|
||||
See the MinIO Operator :minio-git:`CRD Reference <operator/blob/master/docs/tenant_crd.adoc>` for complete documentation on the MinIO CRD.
|
||||
|
||||
- The MinIO Kubernetes Plugin brings native support for deploying and managing MinIO tenants on a Kubernetes cluster using the :mc:`kubectl minio` command.
|
||||
The MinIO Operator installs a :kube-docs:`Custom Resource Definition (CRD) <concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions>` to support describing MinIO tenants as a Kubernetes :kube-docs:`object <concepts/overview/working-with-objects/kubernetes-objects/>`.
|
||||
See the MinIO Operator :minio-git:`CRD Reference <operator/blob/master/docs/tenant_crd.adoc>` for complete documentation on the MinIO CRD.
|
||||
|
||||
This documentation assumes familiarity with referenced Kubernetes concepts, utilities, and procedures.
|
||||
While this documentation *may* provide guidance for configuring or deploying Kubernetes-related resources on a best-effort basis, it is not a replacement for the official :kube-docs:`Kubernetes Documentation <>`.
|
||||
|
||||
|
||||
MinIO Operator Components
|
||||
-------------------------
|
||||
|
||||
The MinIO Operator exists in its own namespace.
|
||||
|
||||
Within the Operator's namespace, the MinIO Operator utilizes two pods:
|
||||
|
||||
- The Operator pod for the base Operator functions to deploy, manage, modify, and maintain tenants.
|
||||
- Console pod for the Operator's Graphical User Interface, the Operator Console.
|
||||
|
||||
@ -64,30 +63,30 @@ The tenant utilizes Persistent Volume Claims to talk to the Persistent Volumes t
|
||||
Prerequisites
|
||||
-------------
|
||||
|
||||
Kubernetes Version 1.19.0
|
||||
Kubernetes Version 1.21.0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. important::
|
||||
|
||||
MinIO **strongly recommends** upgrading Production clusters running `End-Of-Life <https://kubernetes.io/releases/patch-releases/#non-active-branch-history>`__ Kubernetes APIs.
|
||||
|
||||
Starting with v4.0.0, the MinIO Operator and MinIO Kubernetes Plugin **require** Kubernetes 1.19.0 and later.
|
||||
The Kubernetes infrastructure *and* the ``kubectl`` CLI tool must have the same version of 1.19.0+.
|
||||
|
||||
Prior to v4.0.0, the MinIO Operator and Plugin required Kubernetes 1.17.0.
|
||||
You *must* upgrade your Kubernetes infrastructure to 1.19.0 or later to use the MinIO Operator or Plugin v4.0.0 or later.
|
||||
|
||||
Starting with v5.0.0, MinIO *recommends* Kubernetes 1.21.0 or later for both the infrastructure and the ``kubectl`` CLI tool.
|
||||
Starting with v5.0.0, MinIO **requires** Kubernetes 1.21.0 or later for both the infrastructure and the ``kubectl`` CLI tool.
|
||||
|
||||
.. versionadded:: Operator 5.0.6
|
||||
|
||||
For Kubernetes 1.25.0 and later, MinIO supports deploying in environments with the :kube-docs:`Pod Security admission (PSA) <concepts/security/pod-security-admission>` ``restricted`` policy enabled.
|
||||
|
||||
|
||||
``kubectl`` Configuration
|
||||
Kustomize and ``kubectl``
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
This procedure assumes that your local host machine has both the correct version of ``kubectl`` for your Kubernetes cluster *and* the necessary access to that cluster to create new resources.
|
||||
`Kustomize <https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization>`__ is a YAML-based templating tool that allows you to define Kubernetes resources in a declarative and repeatable fashion.
|
||||
Kustomize is included with the :kube-docs:`kubectl <reference/kubectl>` command line tool.
|
||||
|
||||
This procedure assumes that your local host machine has both the matching version of ``kubectl`` for your Kubernetes cluster *and* the necessary access to that cluster to create new resources.
|
||||
|
||||
The `default MinIO Operator Kustomize template <https://github.com/minio/operator/blob/master/kustomization.yaml>`__ provides a starting point for customizing configurations for your local environment.
|
||||
You can modify the default Kustomization file or apply your own `patches <https://datatracker.ietf.org/doc/html/rfc6902>`__ to customize the Operator deployment for your Kubernetes cluster.
|
||||
|
||||
.. _minio-k8s-deploy-operator-tls:
|
||||
|
||||
@ -162,15 +161,14 @@ The output of the example command above may differ from the output in your termi
|
||||
Procedure
|
||||
---------
|
||||
|
||||
The following steps deploy Operator using the MinIO Kubernetes Plugin.
|
||||
The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
|
||||
To install Operator using a Helm chart, see :ref:`Deploy Operator with Helm <minio-k8s-deploy-operator-helm>`.
|
||||
|
||||
.. include:: /includes/common/common-install-operator-kubectl-plugin.rst
|
||||
.. include:: /includes/common/common-install-operator-kustomize.rst
|
||||
|
||||
.. toctree::
|
||||
:titlesonly:
|
||||
:hidden:
|
||||
|
||||
/operations/install-deploy-manage/deploy-operator-helm
|
||||
/operations/install-deploy-manage/deploy-operator-kustomize
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ You can install the MinIO plugin using either the Kubernetes Krew plugin manager
|
||||
|
||||
Krew is a ``kubectl`` plugin manager developed by the `Kubernetes SIG CLI group <https://github.com/kubernetes-sigs>`__.
|
||||
See the ``krew`` `installation documentation <https://krew.sigs.k8s.io/docs/user-guide/setup/install/>`__ for specific instructions.
|
||||
You can use the Krew plugin for Linux, MacOS, and Windows operating systems.
|
||||
You can use the Krew plugin for Linux, macOS, and Windows operating systems.
|
||||
|
||||
You can use Krew to install the MinIO ``kubectl`` plugin using the following commands:
|
||||
|
||||
@ -23,27 +23,18 @@ You can install the MinIO plugin using either the Kubernetes Krew plugin manager
|
||||
|
||||
kubectl krew upgrade minio
|
||||
|
||||
You can validate the installation of the MinIO plugin using the following command:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio version
|
||||
|
||||
The output should match |operator-version-stable|.
|
||||
|
||||
.. tab-item:: Manual (Linux, MacOS)
|
||||
|
||||
You can download the MinIO ``kubectl`` plugin to your local system path.
|
||||
The ``kubectl`` CLI automatically discovers and runs compatible plugins.
|
||||
|
||||
The following code downloads the latest stable version |operator-version-stable| of the MinIO Kubernetes plugin and installs it to the system path:
|
||||
The following code downloads the most recent version of the MinIO Kubernetes plugin and installs it to the system path:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
:class: copyable
|
||||
|
||||
curl https://github.com/minio/operator/releases/download/v|operator-version-stable|/kubectl-minio_|operator-version-stable|_linux_amd64 -o kubectl-minio
|
||||
curl https://github.com/minio/operator/releases/download/v5.0.14/kubectl-minio_5.0.14_linux_amd64 -o kubectl-minio
|
||||
chmod +x kubectl-minio
|
||||
mv kubectl-minio /usr/local/bin/
|
||||
|
||||
@ -56,20 +47,20 @@ You can install the MinIO plugin using either the Kubernetes Krew plugin manager
|
||||
|
||||
kubectl minio version
|
||||
|
||||
The output should display the Operator version as |operator-version-stable|.
|
||||
The output should display the Operator version as 5.0.14.
|
||||
|
||||
.. tab-item:: Manual (Windows)
|
||||
|
||||
You can download the MinIO ``kubectl`` plugin to your local system path.
|
||||
The ``kubectl`` CLI automatically discovers and runs compatible plugins.
|
||||
|
||||
The following PowerShell command downloads the latest stable version |operator-version-stable| of the MinIO Kubernetes plugin and installs it to the system path:
|
||||
The following PowerShell command downloads the most recent version of the MinIO Kubernetes plugin and installs it to the system path:
|
||||
|
||||
.. code-block:: powershell
|
||||
:substitutions:
|
||||
:class: copyable
|
||||
|
||||
Invoke-WebRequest -Uri "https://github.com/minio/operator/releases/download/v|operator-version-stable|/kubectl-minio_|operator-version-stable|_windows_amd64.exe" -OutFile "C:\kubectl-plugins\kubectl-minio.exe"
|
||||
Invoke-WebRequest -Uri "https://github.com/minio/operator/releases/download/v5.0.14/kubectl-minio_5.0.14_windows_amd64.exe" -OutFile "C:\kubectl-plugins\kubectl-minio.exe"
|
||||
|
||||
Ensure the path to the plugin folder is included in the Windows PATH.
|
||||
|
||||
@ -80,4 +71,4 @@ You can install the MinIO plugin using either the Kubernetes Krew plugin manager
|
||||
|
||||
kubectl minio version
|
||||
|
||||
The output should display the Operator version as |operator-version-stable|.
|
||||
The output should display the Operator version as 5.0.14.
|
||||
|
||||
@ -4,24 +4,10 @@ Deploy MinIO Tenant with Active Directory / LDAP Identity Management
|
||||
1) Access the Operator Console
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Use the :mc-cmd:`kubectl minio proxy` command to temporarily forward traffic between the local host machine and the MinIO Operator Console:
|
||||
Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
|
||||
For instructions, see :ref:`Configure access to the Operator Console service <minio-k8s-deploy-operator-access-console>`.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio proxy
|
||||
|
||||
The command returns output similar to the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
Starting port forward of the Console UI.
|
||||
|
||||
To connect open a browser and go to http://localhost:9001
|
||||
|
||||
Current JWT to login: TOKEN
|
||||
|
||||
Open your browser to the specified URL and enter the JWT Token into the login page.
|
||||
Open your browser to the temporary URL and enter the JWT Token into the login page.
|
||||
You should see the :guilabel:`Tenants` page:
|
||||
|
||||
.. image:: /images/k8s/operator-dashboard.png
|
||||
|
||||
@ -4,24 +4,10 @@ Deploy MinIO Tenant with Server-Side Encryption
|
||||
1) Access the Operator Console
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Use the :mc-cmd:`kubectl minio proxy` command to temporarily forward traffic between the local host machine and the MinIO Operator Console:
|
||||
Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
|
||||
For instructions, see :ref:`Configure access to the Operator Console service <minio-k8s-deploy-operator-access-console>`.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio proxy
|
||||
|
||||
The command returns output similar to the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
Starting port forward of the Console UI.
|
||||
|
||||
To connect open a browser and go to http://localhost:9001
|
||||
|
||||
Current JWT to login: TOKEN
|
||||
|
||||
Open your browser to the specified URL and enter the JWT Token into the login page.
|
||||
Open your browser to the temporary URL and enter the JWT Token into the login page.
|
||||
You should see the :guilabel:`Tenants` page:
|
||||
|
||||
.. image:: /images/k8s/operator-dashboard.png
|
||||
@ -64,4 +50,4 @@ Once you have completed the configuration, you can finish any remaining sections
|
||||
|
||||
.. include:: /includes/k8s/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
|
||||
@ -4,24 +4,10 @@ Deploy MinIO Tenant with OpenID Connect Identity Management
|
||||
1) Access the Operator Console
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Use the :mc-cmd:`kubectl minio proxy` command to temporarily forward traffic between the local host machine and the MinIO Operator Console:
|
||||
Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
|
||||
For instructions, see :ref:`Configure access to the Operator Console service <minio-k8s-deploy-operator-access-console>`.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio proxy
|
||||
|
||||
The command returns output similar to the following:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
Starting port forward of the Console UI.
|
||||
|
||||
To connect open a browser and go to http://localhost:9001
|
||||
|
||||
Current JWT to login: TOKEN
|
||||
|
||||
Open your browser to the specified URL and enter the JWT Token into the login page.
|
||||
Open your browser to the temporary URL and enter the JWT Token into the login page.
|
||||
You should see the :guilabel:`Tenants` page:
|
||||
|
||||
.. image:: /images/k8s/operator-dashboard.png
|
||||
|
||||
@ -1,286 +0,0 @@
|
||||
.. _minio-k8s-deploy-minio-tenant-commandline:
|
||||
|
||||
Deploy a MinIO Tenant using the Command Line
|
||||
--------------------------------------------
|
||||
|
||||
The :mc:`kubectl minio tenant create` command supports creating a MinIO Tenant in your Kubernetes cluster.
|
||||
The command *requires* that the cluster have a functional MinIO Operator installation.
|
||||
|
||||
To deploy a tenant from the command line, complete the following steps:
|
||||
|
||||
:ref:`create-tenant-cli-determine-settings-required-options`
|
||||
|
||||
:ref:`create-tenant-cli-determine-additional-options`
|
||||
|
||||
:ref:`create-tenant-cli-enter-command`
|
||||
|
||||
:ref:`create-tenant-cli-record-access-info`
|
||||
|
||||
:ref:`create-tenant-cli-access-tenant-console`
|
||||
|
||||
.. _create-tenant-cli-determine-settings-required-options:
|
||||
|
||||
1) Determine Values for Required Settings
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The :mc:`kubectl minio tenant create` command requires several configuration settings.
|
||||
Determine the values for all required settings.
|
||||
|
||||
.. tab-set::
|
||||
|
||||
.. tab-item:: Required Settings
|
||||
|
||||
The command requires values for each of the items in this table.
|
||||
|
||||
.. list-table::
|
||||
:header-rows: 1
|
||||
:widths: 25 75
|
||||
:width: 100%
|
||||
|
||||
* - Setting
|
||||
- Description
|
||||
|
||||
* - :mc:`~kubectl minio tenant create TENANT_NAME`
|
||||
- The name to use for the new tenant.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --capacity`
|
||||
- The total raw storage size for the Tenant across all volumes.
|
||||
Specify both the total storage size *and* the :guilabel:`Unit` of that storage.
|
||||
All storage units are in SI values, e.g. :math:`Gi = GiB = 1024^3` bytes.
|
||||
|
||||
For example, 16 Ti for 16 Tebibytes.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --servers`
|
||||
- The total number of MinIO server pods to deploy in the Tenant.
|
||||
|
||||
The Operator by default uses pod anti-affinity, such that the Kubernetes cluster *must* have at least one worker node per MinIO server pod.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --volumes`
|
||||
- The total number of storage volumes (Persistent Volume Claims).
|
||||
The Operator generates an equal number of PVC *plus one* for supporting logging.
|
||||
|
||||
The total number of persistent volume claims (``PVC``) per server is determined by dividing the number of volumes by the number of servers.
|
||||
The storage available for each ``PVC`` is determined by dividing the capacity by the number of volumes.
|
||||
|
||||
The generated claims have pod selectors so that claims are only made for volumes attached to node running the pod.
|
||||
|
||||
If the number of volumes exceeds the numnber of persistent volumes available on the cluster, ``MinIO`` hangs until the number of persistent volumes are available.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --namespace`
|
||||
- Each MinIO tenant requires its own ``namespace``.
|
||||
|
||||
Specify a namespace with the :mc:`~kubectl minio tenant create --namespace` flag.
|
||||
If not specified, the MinIO Operator to uses ``minio``.
|
||||
|
||||
The namespace must already exist in the Kubernetes cluster.
|
||||
Run ``kubectl create ns <new_namespace>`` to add one.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --storage-class`
|
||||
- Specify the storage class to use.
|
||||
|
||||
New MinIO tenants use the ``default`` storage class.
|
||||
To specify a different storage class, add the :mc:`~kubectl minio tenant create --storage-class` flag.
|
||||
|
||||
The specified :mc-cmd:`~kubectl minio tenant create --storage-class` *must* match the ``storage-class`` of the Persistent Volumes (``PVs``) to which the ``PVCs`` should bind.
|
||||
|
||||
MinIO strongly recommends creating a Storage Class that corresponds to locally-attached volumes on the host machines on which the Tenant deploys.
|
||||
This ensures each pod can use locally-attached storage for maximum performance and throughput.
|
||||
|
||||
.. tab-item:: Example
|
||||
|
||||
For example, the following command creates a new tenant with the following settings:
|
||||
|
||||
Name
|
||||
``miniotenant``
|
||||
|
||||
Capacity
|
||||
16 Tebibytes
|
||||
|
||||
Servers
|
||||
4
|
||||
|
||||
Volumes
|
||||
16
|
||||
|
||||
Namespace
|
||||
``minio``
|
||||
|
||||
Storage Class
|
||||
``warm``
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl minio tenant create miniotenant \
|
||||
--capacity 16Ti \
|
||||
--servers 4 \
|
||||
--volumes 16 \
|
||||
--namespace minio \
|
||||
--storage-class warm
|
||||
|
||||
|
||||
.. _create-tenant-cli-determine-additional-options:
|
||||
|
||||
2) Determine Values for Optional Settings
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You can further customize your tenant by including any or all of the following *optional* flags when running the :mc:`kubectl minio tenant create` command:
|
||||
|
||||
.. list-table::
|
||||
:header-rows: 1
|
||||
:widths: 25 75
|
||||
:width: 100%
|
||||
|
||||
* - Setting
|
||||
- Description
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --image`
|
||||
- Customize the ``minio`` image to use.
|
||||
|
||||
By default, the Operator uses the release image available at the time of the Operator's release.
|
||||
To specify a different MinIO version for the tenant, such as the latest available, use the :mc:`~kubectl minio tenant create --image` flag.
|
||||
|
||||
See the `MinIO Quay <https://quay.io/repository/minio/minio>`__ or the `MinIO DockerHub <https://hub.docker.com/r/minio/minio/tags>`__ repositories for a list of valid tags.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --image-pull-secret`
|
||||
- If using a custom container registry, specify the secret to use when pulling the ``minio`` image.
|
||||
|
||||
Use :mc:`~kubectl minio tenant create --image-pull-secret` to specify the secret.
|
||||
|
||||
* - :mc:`~kubectl minio tenant create --kes-config`
|
||||
- Configure a :minio-git:`Key Encrption Service (KES) <kes>`
|
||||
|
||||
Use the :mc:`~kubectl minio tenant create --kes-config` flag to specify the name of the secret to use for KES Key Management Service (KMS) setup.
|
||||
|
||||
Enabling Server Side Encryption (SSE) also deploys a MinIO :minio-git:`KES <kes>` service in the Tenant to faciliate SSE operations.
|
||||
|
||||
For more, see the `Github documentation <https://github.com/minio/kes/wiki>`__.
|
||||
|
||||
.. note:: Generate a YAML File for Further Customizations
|
||||
|
||||
The MinIO Operator installs a `Custom Resource Definition (CRD) <https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/>`__ to describe tenants.
|
||||
Advanced users can generate a YAML file from the command line and customize the tenant based on the CRD.
|
||||
|
||||
Do a dry run of a tenant creation process to generate a YAML file using the :mc:`~kubectl minio tenant create --output` flag.
|
||||
|
||||
When using this flag, the operator does **not** create the tenant.
|
||||
Modify the generated YAML file as desired, then use ``kubectl apply -f <FILE>`` to manually create the MinIO tenant using the file.
|
||||
|
||||
.. _create-tenant-cli-enter-command:
|
||||
|
||||
3) Run the Command with Required and Optional Settings
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
At the command line, enter the full command with all *Required* and any *Optional* flags.
|
||||
|
||||
Consider a tenant we want to create:
|
||||
|
||||
Tenant Name
|
||||
``minio1``
|
||||
|
||||
Capacity
|
||||
16 Tebibytes
|
||||
|
||||
Servers
|
||||
4
|
||||
|
||||
Volumes
|
||||
16 (four per node)
|
||||
|
||||
Namespace
|
||||
``miniotenantspace``
|
||||
|
||||
MinIO Image
|
||||
Latest version, |minio-latest|
|
||||
|
||||
Key ecnryption file
|
||||
``minio-secret``
|
||||
|
||||
Storage class
|
||||
``warm``
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
kubectl minio tenant create \
|
||||
minio1 \
|
||||
--capacity 16Ti \
|
||||
--servers 4 \
|
||||
--volumes 16 \
|
||||
--namespace miniotenantspace \
|
||||
--image |minio-latest| \
|
||||
--kes-config minio-kes-secret \
|
||||
--storage-class warm
|
||||
|
||||
.. _create-tenant-cli-record-access-info:
|
||||
|
||||
4) Record the Access Credentials
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
When generating the tenant, the MinIO Operator displays the access credentials to use for the tenant.
|
||||
|
||||
.. important::
|
||||
|
||||
This is the only time the credentials display.
|
||||
Copy the credentials to a secure location.
|
||||
MinIO does not show these credentials again.
|
||||
|
||||
In addition to access credentials, the output shows the service name and service ports to use for accessing the tenant.
|
||||
|
||||
.. _create-tenant-cli-access-tenant-console:
|
||||
|
||||
5) Access the Tenant's MinIO Console
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The MinIO Operator creates services for the MinIO Tenant.
|
||||
|
||||
.. cond:: openshift
|
||||
|
||||
Use the ``oc get svc -n TENANT-PROJECT`` command to review the deployed services:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
oc get svc -n minio-tenant-1
|
||||
|
||||
.. cond:: k8s and not openshift
|
||||
|
||||
Use the ``kubectl get svc -n NAMESPACE`` command to review the deployed services:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kubectl get svc -n minio-tenant-1
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
minio LoadBalancer 10.97.114.60 <pending> 443:30979/TCP 2d3h
|
||||
minio-tenant-1-console LoadBalancer 10.106.103.247 <pending> 9443:32095/TCP 2d3h
|
||||
minio-tenant-1-hl ClusterIP None <none> 9000/TCP 2d3h
|
||||
minio-tenant-1-log-hl-svc ClusterIP None <none> 5432/TCP 2d3h
|
||||
minio-tenant-1-log-search-api ClusterIP 10.103.5.235 <none> 8080/TCP 2d3h
|
||||
minio-tenant-1-prometheus-hl-svc ClusterIP None <none> 9090/TCP 7h39m
|
||||
|
||||
- The ``minio`` service corresponds to the MinIO Tenant service.
|
||||
Applications should use this service for performing operations against the MinIO Tenant.
|
||||
|
||||
- The ``*-console`` service corresponds to the :minio-git:`MinIO Console <console>`.
|
||||
Administrators should use this service for accessing the MinIO Console and performing administrative operations on the MinIO Tenant.
|
||||
|
||||
The remaining services support Tenant operations and are not intended for consumption by users or administrators.
|
||||
|
||||
By default each service is visible only within the Kubernetes cluster.
|
||||
Applications deployed inside the cluster can access the services using the ``CLUSTER-IP``.
|
||||
|
||||
Applications external to the Kubernetes cluster can access the services using the ``EXTERNAL-IP``.
|
||||
This value is only populated for Kubernetes clusters configured for Ingress or a similar network access service.
|
||||
Kubernetes provides multiple options for configuring external access to services.
|
||||
|
||||
.. cond:: k8s and not openshift
|
||||
|
||||
See the Kubernetes documentation on :kube-docs:`Publishing Services (ServiceTypes) <concepts/services-networking/service/#publishing-services-service-types>` and :kube-docs:`Ingress <concepts/services-networking/ingress/>` for more complete information on configuring external access to services.
|
||||
|
||||
.. cond:: openshift
|
||||
|
||||
See the OpenShift documentation on :openshift-docs:`Route or Ingress <networking/understanding-networking.html#nw-ne-comparing-ingress-route_understanding-networking>` for more complete information on configuring external access to services.
|
||||
@ -53,13 +53,6 @@ OpenShift ``oc`` CLI
|
||||
|
||||
:openshift-docs:`Download and Install <cli_reference/openshift_cli/getting-started-cli.html>` the OpenShift :abbr:`CLI (command-line interface)` ``oc`` for use in this procedure.
|
||||
|
||||
MinIO ``kubectl`` Plugin
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The MinIO Kubernetes Plugin provides a command line interface for the MinIO Operator.
|
||||
This procedure uses the ``oc minio`` plugin as part of the installation.
|
||||
|
||||
.. include:: /includes/openshift/install-minio-kubectl-plugin.rst
|
||||
|
||||
Procedure
|
||||
---------
|
||||
|
||||
@ -1,53 +0,0 @@
|
||||
You can install the MinIO Kubernetes plugin by downloading and installing the plugin binary to your local host:
|
||||
|
||||
.. tab-set::
|
||||
|
||||
.. tab-item:: Linux, MacOS
|
||||
|
||||
You can download the MinIO ``kubectl`` plugin to your local system path.
|
||||
The ``oc`` CLI automatically discovers and runs compatible plugins.
|
||||
|
||||
The following code downloads the latest stable version |operator-version-stable| of the MinIO Kubernetes plugin and installs it to the system path:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
:class: copyable
|
||||
|
||||
curl https://github.com/minio/operator/releases/download/v|operator-version-stable|/kubectl-minio_|operator-version-stable|_linux_amd64 -o kubectl-minio
|
||||
chmod +x kubectl-minio
|
||||
mv kubectl-minio /usr/local/bin/
|
||||
|
||||
The ``mv`` command above may require ``sudo`` escalation depending on the permissions of the authenticated user.
|
||||
|
||||
Run the following command to verify installation of the plugin:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
oc minio version
|
||||
|
||||
The output should display the Operator version as |operator-version-stable|.
|
||||
|
||||
.. tab-item:: Windows
|
||||
|
||||
You can download the MinIO ``kubectl`` plugin to your local system path.
|
||||
The ``oc`` CLI automatically discovers and runs compatible plugins.
|
||||
|
||||
The following PowerShell command downloads the latest stable version |operator-version-stable| of the MinIO Kubernetes plugin and installs it to the system path:
|
||||
|
||||
.. code-block:: powershell
|
||||
:substitutions:
|
||||
:class: copyable
|
||||
|
||||
Invoke-WebRequest -Uri "https://github.com/minio/operator/releases/download/v|operator-version-stable|/kubectl-minio_|operator-version-stable|_windows_amd64.exe" -OutFile "C:\kubectl-plugins\kubectl-minio.exe"
|
||||
|
||||
Ensure the path to the plugin folder is included in the Windows PATH.
|
||||
|
||||
Run the following command to verify installation of the plugin:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
oc minio version
|
||||
|
||||
The output should display the Operator version as |operator-version-stable|.
|
||||
Reference in New Issue
Block a user