Document OpenShift service certificates for Operator deployments #1002

feorlen · 2023-09-13T22:03:32Z

MinIO Operator on OpenShift may require manual configuration of TLS cert management via the OpenShift service-ca Operator. (For deployments that are not done through Red Hat OperatorHub.)

Document the needed envvars, volumes, and volumeMounts to enable service-ca and avoid the need to manually renew certs.

~~Note: This presumes kustomize, additional research/testing required to determine configuration for Helm chart deployments.~~

Staged
http://192.241.195.202:9000/staging/DOCS-991/openshift/operations/installation.html#procedure

See also: https://github.com/minio/wiki/wiki/Besides-MINIO_OPERATOR_RUNTIME-what-else-is-needed-in-Operator%3F

Fixes #991 (remaining item for v5.0.8)

feorlen · 2023-09-13T23:14:11Z

source/default-conf.py

@@ -65,7 +65,7 @@
    'podman-docs'     : ('https://docs.podman.io/en/latest/%s', None),
    'podman-git'      : ('https://github.com/containers/podman/%s', None),
    'docker-docs'     : ('https://docs.docker.com/%s', None),
-    'openshift-docs'  : ('https://docs.openshift.com/container-platform/4.11/%s', None),
+    'openshift-docs'  : ('https://docs.openshift.com/container-platform/4.13/%s', None),


Might as well? Too bad Red Hat docs don't have an equivalent of latest.

No harm in bumping!

source/includes/openshift/deploy-minio-on-openshift.rst

feorlen · 2023-09-13T23:22:34Z

source/includes/openshift/deploy-minio-on-openshift.rst

+         * - Environment Variable
+           - Value
+
+         * - :envvar:`MINIO_CONSOLE_TLS_ENABLE`


I found this in https://github.com/minio/operator/blob/3baa9696df34b127c2fdb20306192bd44a1c86bd/docs/env-variables.md but it's not in the giant list of envvars at the moment. I think most of the envvars in that file are not. (Because Operator, not MinIO Server.)

Appears OPERATOR_STS_ENABLED is not required unless you are messing with STS. Which is beyond the scope of this page. It defaults to off.

feorlen · 2023-09-13T23:30:49Z

source/includes/openshift/deploy-minio-on-openshift.rst

+         * - :envvar:`MINIO_OPERATOR_RUNTIME`
+           - ``OpenShift``
+
+   #. Configure the following ``volumes`` and ``volumeMounts`` in ``something.yaml``:


I'm unclear where this YAML is updated

This is in the Operator deployment. Celis has a YAML file to use with oc apply that will do this for you, no editing needed (for "standard" environments)

Added example of editing the file. Can dig into the oc apply method on a future revisit. (Unclear where that YAML file should live.)

feorlen · 2023-09-15T17:16:48Z

source/includes/openshift/deploy-minio-on-openshift.rst

@@ -16,7 +17,7 @@ Overview
 Red Hat® OpenShift® is an enterprise-ready Kubernetes container platform with full-stack automated operations to manage hybrid cloud, multi-cloud, and edge deployments. 
 OpenShift includes an enterprise-grade Linux operating system, container runtime, networking, monitoring, registry, and authentication and authorization solutions. 

-You can deploy the MinIO Kubernetes Operator through the :openshift-docs:`Red Hat® OpenShift® Container Platform 4.7+ <welcome/index.html>`. 
+You can deploy the MinIO Kubernetes Operator through the :openshift-docs:`Red Hat® OpenShift® Container Platform 4.8+ <welcome/index.html>`. 


Per Celis, Red Hat said we have to be 4.8+ now.

@cniackz is there a specific Operator version where that bump happened? We might want to maintain a matrix somewhere, at least internally.

Hello @ravindk89,

Our ability to influence this situation is limited. I recall that certification tests would fail if we attempted to cover versions 4.7 or older, necessitating our decision to cease coverage of those versions and progress towards more recent ones.

Furthermore, if you visit their website, you will notice that full support for that particular version has already concluded: https://access.redhat.com/support/policy/updates/openshift

Best regards,

feorlen · 2023-09-15T17:19:24Z

source/includes/openshift/deploy-minio-on-openshift.rst

@@ -70,39 +71,38 @@ Select the tab that corresponds to your preferred installation method:

 .. tab-set::

-   .. tab-item:: Red Hat Marketplace
+   .. tab-item:: Red Hat OperatorHub


Switched order of these tabs, because using OperatorHub saves you from several annoyances and we should encourage it.

Marketplace does lead you to OperatorHub, but in a roundabout way that few people do. (I.e. paying Red Hat instead of us directly.)

"changes" from here through line 105 are all because of the tab reorder. (Improvements to existing welcome, as always.)

source/includes/openshift/deploy-minio-on-openshift.rst

cniackz · 2023-09-15T18:05:44Z

I know this is a draft, but I loved the way it looks in the web page provided at: http://192.241.195.202:9000/staging/DOCS-991/openshift/operations/installation.html#configure-tls-certificates
This to me looks good!

feorlen · 2023-09-15T19:50:00Z

source/includes/k8s/deploy-operator.rst

@@ -95,7 +95,7 @@ Kubernetes TLS Certificate API
   The MinIO Operator manages TLS Certificate Signing Requests (CSR) using the Kubernetes ``certificates.k8s.io`` :kube-docs:`TLS certificate management API <tasks/tls/managing-tls-in-a-cluster/>` to create signed TLS certificates in the following circumstances:

   - When ``autoCert`` is enabled.
-   - For the MinIO Console when the :envvar:`OPERATOR_CONSOLE_TLS_ENABLE` environment variable is set to ``on``.
+   - For the MinIO Console when the :envvar:`MINIO_CONSOLE_TLS_ENABLE` environment variable is set to ``on``.


OPERATOR_CONSOLE_TLS_ENABLE was an oops the correct name is MINIO_CONSOLE_TLS_ENABLE

ravindk89

One minor nit, I don't see anything otherwise here that is a concern. Lovely bit of work.

ravindk89 · 2023-09-18T15:25:20Z

source/default-conf.py

@@ -65,7 +65,7 @@
    'podman-docs'     : ('https://docs.podman.io/en/latest/%s', None),
    'podman-git'      : ('https://github.com/containers/podman/%s', None),
    'docker-docs'     : ('https://docs.docker.com/%s', None),
-    'openshift-docs'  : ('https://docs.openshift.com/container-platform/4.11/%s', None),
+    'openshift-docs'  : ('https://docs.openshift.com/container-platform/4.13/%s', None),


No harm in bumping!

ravindk89 · 2023-09-18T15:25:46Z

source/includes/openshift/deploy-minio-on-openshift.rst

@@ -16,7 +17,7 @@ Overview
 Red Hat® OpenShift® is an enterprise-ready Kubernetes container platform with full-stack automated operations to manage hybrid cloud, multi-cloud, and edge deployments. 
 OpenShift includes an enterprise-grade Linux operating system, container runtime, networking, monitoring, registry, and authentication and authorization solutions. 

-You can deploy the MinIO Kubernetes Operator through the :openshift-docs:`Red Hat® OpenShift® Container Platform 4.7+ <welcome/index.html>`. 
+You can deploy the MinIO Kubernetes Operator through the :openshift-docs:`Red Hat® OpenShift® Container Platform 4.8+ <welcome/index.html>`. 


@cniackz is there a specific Operator version where that bump happened? We might want to maintain a matrix somewhere, at least internally.

source/includes/openshift/deploy-minio-on-openshift.rst

feorlen added 2 commits September 13, 2023 13:15

update openshift-docs link to their latest version

0e090c2

Draft OpenShift service-ca detail

c73c1ef

feorlen self-assigned this Sep 13, 2023

feorlen marked this pull request as draft September 13, 2023 22:03

feorlen commented Sep 13, 2023

View reviewed changes

source/includes/openshift/deploy-minio-on-openshift.rst Outdated Show resolved Hide resolved

feorlen commented Sep 13, 2023

View reviewed changes

source/includes/openshift/deploy-minio-on-openshift.rst Outdated Show resolved Hide resolved

feorlen commented Sep 13, 2023

View reviewed changes

manual cert config

96b1793

feorlen commented Sep 15, 2023

View reviewed changes

source/includes/openshift/deploy-minio-on-openshift.rst Show resolved Hide resolved

cniackz self-requested a review September 15, 2023 18:05

cniackz approved these changes Sep 15, 2023

View reviewed changes

feorlen marked this pull request as ready for review September 15, 2023 18:34

fixups

cf60e51

feorlen commented Sep 15, 2023

View reviewed changes

ravindk89 approved these changes Sep 18, 2023

View reviewed changes

Update source/includes/openshift/deploy-minio-on-openshift.rst

9b02108

ravindk89 merged commit 62e1447 into main Sep 25, 2023

ravindk89 deleted the DOCS-991 branch September 25, 2023 15:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Document OpenShift service certificates for Operator deployments #1002

Document OpenShift service certificates for Operator deployments #1002

feorlen commented Sep 13, 2023 •

edited

Loading

feorlen Sep 13, 2023

ravindk89 Sep 18, 2023

feorlen Sep 13, 2023 •

edited

Loading

feorlen Sep 14, 2023

feorlen Sep 13, 2023

feorlen Sep 14, 2023

feorlen Sep 15, 2023

feorlen Sep 15, 2023

ravindk89 Sep 18, 2023

cniackz Sep 25, 2023

feorlen Sep 15, 2023

feorlen Sep 15, 2023

cniackz commented Sep 15, 2023

feorlen Sep 15, 2023

ravindk89 left a comment

ravindk89 Sep 18, 2023

ravindk89 Sep 18, 2023

Document OpenShift service certificates for Operator deployments #1002

Document OpenShift service certificates for Operator deployments #1002

Conversation

feorlen commented Sep 13, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

feorlen Sep 13, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cniackz commented Sep 15, 2023

Choose a reason for hiding this comment

ravindk89 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

feorlen commented Sep 13, 2023 •

edited

Loading

feorlen Sep 13, 2023 •

edited

Loading