How to deploy MinIO in Openshift with Audit Log

1. Assuming Operator is already deployed:

2. Create the tenant:

3. Disable TLS

4. Disable Prometheus:

5. Start Addressing securityContext issues:

6. Under the name of the pool I will place an empty securityContext:

  pools:
  - affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchExpressions:
            - key: v1.min.io/tenant
              operator: In
              values:
              - thunov3629pm
            - key: v1.min.io/pool
              operator: In
              values:
              - pool-0
          topologyKey: kubernetes.io/hostname
    name: pool-0
    securityContext: {}

7. Bound the PV with the PVC using the Storage Class defined:

spec:
 storageClassName: cesar

8. Fix Audit Logs:

  log:
    audit:
      diskCapacityGB: 5
    db:
      resources: {}
      securityContext:
        fsGroup: 1000660000
        fsGroupChangePolicy: Always
        runAsGroup: 1000660000
        runAsNonRoot: true
        runAsUser: 1000660000
      volumeClaimTemplate:
        metadata:
          creationTimestamp: null
          name: thunov3629pm-log
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: "5368709120"
        status: {}
    resources: {}
    securityContext:
      fsGroup: 1000660000
      fsGroupChangePolicy: Always
      runAsGroup: 1000660000
      runAsNonRoot: true
      runAsUser: 1000660000

9. For below we need a serviceAccountName: minio-operator with granted permissions because we can't change that context since is implemented by the operator code and tenant is not exposing this one:

  log:
    audit:
      diskCapacityGB: 5
    db:
      resources: {}
      serviceAccountName: minio-operator
      securityContext:
        fsGroup: 1000660000
        fsGroupChangePolicy: Always
        runAsGroup: 1000660000
        runAsNonRoot: true
        runAsUser: 1000660000

oc create serviceaccount minio-operator -n thunov3629pm
oc adm policy add-scc-to-user privileged -n thunov3629pm -z minio-operator

10. Wait some time and DB will be reached:

11. 3 pods running, 2 for logs and 1 for Minio:

12. Tenant ready:

13. Console Accesible: