Document OpenShift service certificates for Operator deployments #1002
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
|
|
||
| .. _deploy-operator-openshift: | ||
|
|
||
| ========================================= | ||
|
|
@@ -16,7 +17,7 @@ Overview | |
| Red Hat® OpenShift® is an enterprise-ready Kubernetes container platform with full-stack automated operations to manage hybrid cloud, multi-cloud, and edge deployments. | ||
| OpenShift includes an enterprise-grade Linux operating system, container runtime, networking, monitoring, registry, and authentication and authorization solutions. | ||
|
|
||
| You can deploy the MinIO Kubernetes Operator through the :openshift-docs:`Red Hat® OpenShift® Container Platform 4.8+ <welcome/index.html>`. | ||
|
There was a problem hiding this comment. Per Celis, Red Hat said we have to be There was a problem hiding this comment. @cniackz is there a specific Operator version where that bump happened? We might want to maintain a matrix somewhere, at least internally. There was a problem hiding this comment. Hello @ravindk89, Our ability to influence this situation is limited. I recall that certification tests would fail if we attempted to cover versions 4.7 or older, necessitating our decision to cease coverage of those versions and progress towards more recent ones. Furthermore, if you visit their website, you will notice that full support for that particular version has already concluded: https://access.redhat.com/support/policy/updates/openshift Best regards, 
|
||
| You can deploy and manage MinIO Tenants through OpenShift after deploying the MinIO Operator. | ||
| This procedure includes instructions for the following deployment paths: | ||
|
|
||
|
|
@@ -26,15 +27,15 @@ This procedure includes instructions for the following deployment paths: | |
| After deploying the MinIO Operator into your OpenShift cluster, you can create and manage MinIO Tenants through the :openshift-docs:`OperatorHub <operators/understanding/olm-understanding-operatorhub.html>` user interface. | ||
|
|
||
| This documentation assumes familiarity with all referenced Kubernetes and OpenShift concepts, utilities, and procedures. | ||
| While this documentation *may* provide guidance for configuring or deploying Kubernetes-related or OpenShift-related resources on a best-effort basis, it is not a replacement for the official :kube-docs:`Kubernetes Documentation <>` and :openshift-docs:`OpenShift Container Platform 4.8+ Documentation <welcome/index.html>`. | ||
|
|
||
| Prerequisites | ||
| ------------- | ||
|
|
||
| RedHat OpenShift 4.8+ | ||
| ~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| The MinIO Kubernetes Operator is available starting with `OpenShift 4.8+ <https://docs.openshift.com/container-platform/4.13/welcome/index.html>`__. | ||
|
|
||
| Red Hat Marketplace installation requires registration of the OpenShift cluster with the Marketplace for the necessary namespaces. | ||
| See `Register OpenShift cluster with Red Hat Marketplace <https://marketplace.redhat.com/en-us/documentation/clusters>`__ for complete instructions. | ||
|
|
@@ -70,39 +71,38 @@ Select the tab that corresponds to your preferred installation method: | |
|
|
||
| .. tab-set:: | ||
|
|
||
| .. tab-item:: Red Hat OperatorHub | ||
|
There was a problem hiding this comment. Switched order of these tabs, because using OperatorHub saves you from several annoyances and we should encourage it. Marketplace does lead you to OperatorHub, but in a roundabout way that few people do. (I.e. paying Red Hat instead of us directly.) There was a problem hiding this comment. "changes" from here through line 105 are all because of the tab reorder. (Improvements to existing welcome, as always.) |
||
|
|
||
| Log into the OpenShift Web Console as a user with ``cluster-admin`` privileges. | ||
|
|
||
| From the :guilabel:`Administrator` panel, select :guilabel:`Operators`, then :guilabel:`OperatorHub`. | ||
|
|
||
| From the :guilabel:`OperatorHub` page, type "MinIO" into the :guilabel:`Filter` text entry. Select the :guilabel:`MinIO Operator` tile from the search list. | ||
|
|
||
| .. image:: /images/openshift/minio-openshift-select-minio.png | ||
| :align: center | ||
| :width: 90% | ||
| :class: no-scaled-link | ||
| :alt: From the OperatorHub, search for MinIO, then select the MinIO Tile. | ||
|
|
||
| Select the :guilabel:`MinIO Operator` tile, then click :guilabel:`Install` to begin the installation. | ||
|
|
||
| .. tab-item:: Red Hat Marketplace | ||
|
|
||
| Open the `MinIO Red Hat Marketplace listing <https://marketplace.redhat.com/en-us/products/minio-hybrid-cloud-object-storage>`__ in your browser. | ||
| Click :guilabel:`Login` to log in with your Red Hat Marketplace account. | ||
|
|
||
| After logging in, click :guilabel:`Purchase` to purchase the MinIO Operator for your account. | ||
|
|
||
| After completing the purchase, click :guilabel:`Workplace` from the top navigation and select :guilabel:`My Software`. | ||
|
|
||
| .. image:: /images/openshift/minio-openshift-marketplace-my-software.png | ||
| :align: center | ||
| :width: 90% | ||
| :class: no-scaled-link | ||
| :alt: From the Red Hat Marketplace, select Workplace, then My Software | ||
|
|
||
| Click :guilabel:`MinIO Hybrid Cloud Object Storage` and select :guilabel:`Install Operator` to start the Operator Installation procedure in OpenShift. | ||
|
|
||
| 2) Configure and Deploy the Operator | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
@@ -125,7 +125,7 @@ The :guilabel:`Install Operator` page provides a walkthrough for configuring the | |
|
|
||
| See the :openshift-docs:`Operator Installation Documentation <operators/admin/olm-adding-operators-to-cluster.html#olm-installing-from-operatorhub-using-web-console_olm-adding-operators-to-a-cluster>` :guilabel:`Step 5` for complete descriptions of each displayed option. | ||
|
|
||
| Click :guilabel:`Install` to start the installation procedure. | ||
| The web console displays a widget for tracking the installation progress. | ||
|
|
||
| .. image:: /images/openshift/minio-openshift-operator-installation-progress.png | ||
|
|
@@ -136,19 +136,165 @@ The web console displays a widget for tracking the installation progress. | |
|
|
||
| Once installation completes, click :guilabel:`View Operator` to view the MinIO Operator page. | ||
|
|
||
| 3) Configure TLS Certificates | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| If you have installed the MinIO Operator from Red Hat OperatorHub, the installation process also configures the :openshift-docs:`OpenShift Service CA Operator <security/certificate_types_descriptions/service-ca-certificates.html>`. | ||
| This Operator manages the the TLS certificates required to access the MinIO Operator Console and Tenants. | ||
ravindk89 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| It automatically renews and rotates the certificates 13 months before expiration. | ||
| No additional action is required. | ||
|
|
||
| For Operator installations deployed by other methods, configure the :openshift-docs:`Service CA certificates <security/certificate_types_descriptions/service-ca-certificates.html>` manually. | ||
| See the dropdowns below for details. | ||
|
|
||
| .. dropdown:: OpenShift Service CA Certificate configuration | ||
|
|
||
| To manually enable the ``service-ca`` Operator to manage TLS certificates: | ||
|
|
||
| #. Use the following command to edit the deployment: | ||
|
|
||
| .. code-block:: shell | ||
| :class: copyable | ||
|
|
||
| oc edit deployment minio-operator -n minio-operator | ||
feorlen marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| If needed, replace ``minio-operator`` with the name and namespace of your deployment. | ||
| ``oc edit`` opens the deployment configuration file in an editor. | ||
|
|
||
| #. In the ``spec`` section, add the highlighted MinIO Operator :ref:`environment variables <minio-server-environment-variables>`: | ||
|
|
||
| .. code-block:: shell | ||
| :class: copyable | ||
| :emphasize-lines: 5-8 | ||
|
|
||
| containers: | ||
| - args: | ||
| - controller | ||
| env: | ||
| - name: MINIO_CONSOLE_TLS_ENABLE | ||
| value: 'on' | ||
| - name: MINIO_OPERATOR_RUNTIME | ||
| value: OpenShift | ||
|
|
||
| #. In the ``volumes`` section, add the following volumes and volume mounts: | ||
|
|
||
| - ``sts-tls`` | ||
| - ``openshift-service-ca`` | ||
| - ``openshift-csr-signer-ca`` | ||
|
|
||
| The added volume configuration resembles the following: | ||
|
|
||
| .. code-block:: shell | ||
| :class: copyable | ||
|
|
||
| volumes: | ||
| - name: sts-tls | ||
| projected: | ||
| sources: | ||
| - secret: | ||
| name: sts-tls | ||
| items: | ||
| - key: tls.crt | ||
| path: public.crt | ||
| - key: tls.key | ||
| path: private.key | ||
| optional: true | ||
| defaultMode: 420 | ||
| - name: openshift-service-ca | ||
| configMap: | ||
| name: openshift-service-ca.crt | ||
| items: | ||
| - key: service-ca.crt | ||
| path: service-ca.crt | ||
| defaultMode: 420 | ||
| optional: true | ||
| - name: openshift-csr-signer-ca | ||
| projected: | ||
| sources: | ||
| - secret: | ||
| name: openshift-csr-signer-ca | ||
| items: | ||
| - key: tls.crt | ||
| path: tls.crt | ||
| optional: true | ||
| defaultMode: 420 | ||
| volumeMounts: | ||
| - name: openshift-service-ca | ||
| mountPath: /tmp/service-ca | ||
| - name: openshift-csr-signer-ca | ||
| mountPath: /tmp/csr-signer-ca | ||
| - name: sts-tls | ||
| mountPath: /tmp/sts | ||
|
|
||
| .. dropdown:: OpenShift Service CA Certificate for Helm deployments | ||
|
|
||
| For Helm deployments on OpenShift, add the following :ref:`environment variables <minio-server-environment-variables>` and volumes to the ``values.yaml`` in the Operator Helm chart before deploying. | ||
|
|
||
| The added YAML configuration for the ``operator`` pod resembles the following: | ||
|
|
||
| .. code-block:: | ||
| :class: copyable | ||
|
|
||
| operator: | ||
| env: | ||
| - name: MINIO_OPERATOR_RUNTIME | ||
| value: "OpenShift" | ||
| - name: MINIO_CONSOLE_TLS_ENABLE | ||
| value: "on" | ||
|
|
||
| volumes: | ||
| - name: sts-tls | ||
| projected: | ||
| sources: | ||
| - secret: | ||
| name: sts-tls | ||
| items: | ||
| - key: tls.crt | ||
| path: public.crt | ||
| - key: tls.key | ||
| path: private.key | ||
| optional: true | ||
| defaultMode: 420 | ||
| - name: openshift-service-ca | ||
| configMap: | ||
| name: openshift-service-ca.crt | ||
| items: | ||
| - key: service-ca.crt | ||
| path: service-ca.crt | ||
| defaultMode: 420 | ||
| optional: true | ||
| - name: openshift-csr-signer-ca | ||
| projected: | ||
| sources: | ||
| - secret: | ||
| name: openshift-csr-signer-ca | ||
| items: | ||
| - key: tls.crt | ||
| path: tls.crt | ||
| optional: true | ||
| defaultMode: 420 | ||
| volumeMounts: | ||
| - name: openshift-service-ca | ||
| mountPath: /tmp/service-ca | ||
| - name: openshift-csr-signer-ca | ||
| mountPath: /tmp/csr-signer-ca | ||
| - name: sts-tls | ||
| mountPath: /tmp/sts | ||
|
|
||
|
|
||
| 4) Open the MinIO Operator Interface | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| You can find the MinIO Operator Interface from the :guilabel:`Operators` left-hand navigation header | ||
|
|
||
| 1. Go to :guilabel:`Operators`, then :guilabel:`Installed Operators`. | ||
|
|
||
| 2. For the :guilabel:`Project` dropdown, select :guilabel:`openshift-operators`. | ||
|
|
||
| 3. Select :guilabel:`MinIO Operators` from the list of installed operators. | ||
| The :guilabel:`Status` column must read :guilabel:`Success` to access the Operator interface. | ||
|
|
||
| 5) Access the Operator Console | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| The MinIO Operator includes the Operator Console, a browser-based management interface for managed MinIO tenants. | ||
|
|
@@ -165,15 +311,13 @@ The following steps provides a summary of actions necessary to create a Route. | |
| #. Set the :guilabel:`Hostname` as per your organizations networking and hostname topology. | ||
| Omit the hostname to allow OpenShift to generate it automatically | ||
| #. Set the :guilabel:`Service` to :guilabel:`console` | ||
| #. Set the :Guilabel:`Target Port` to ``9090`` | ||
|
|
||
| You can then access the Operator Console using the configured Route. | ||
| The Operator Console still requires using the generated JWT token for access, which you can generate at any time using ``oc minio port-forward``. | ||
|
|
||
| 6) Next Steps | ||
| ~~~~~~~~~~~~~ | ||
|
|
||
| After deploying the MinIO Operator, you can create a new MinIO Tenant. | ||
| To deploy a MinIO Tenant using OpenShift, see :ref:`deploy-minio-tenant-redhat-openshift`. | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Might as well? Too bad Red Hat docs don't have an equivalent of
latest.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No harm in bumping!