Fix Subpath behavior

[dvaldivia]

Fixes subpath behavior for Console

How to Test this PR

Vanilla nginx

Assuming we are exposing the console under http://localhost:8000/console/subpath/

1. Make assets via make assets and build MinIO with this branch of console
2. Start MinIO for a given Subpath

CI=true;MINIO_BROWSER_REDIRECT_URL=http://localhost:8000/console/subpath/;MINIO_SERVER_URL=http://localhost:9000 minio --console-address ":9090"

3. Start nginx with the following configuraiton

events { worker_connections 1024; }

http {

server {
    listen 8000;

    location /console/subpath/ {
        rewrite   ^/console/subpath/(.*) /$1 break;
        proxy_pass http://localhost:9090;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # This allows WebSocket connections
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

}

with the command

nginx -c /PATH/TO/nginx.conf -g "daemon off;"

4. Visit http://localhost:8000/console/subpath/ on a browser

In Kubernetes with nginx ingress

1. Create a Tenant with the the address for console under a subpath:

  features:
    domains:
      console: https://ns-1.minio-x1/console/subpath/
      minio:
        - https://ns-1.minio-x1

Full Tenant Example:

apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: subpath-tenant
  namespace: ns-1
spec:
  configuration:
    name: subpath-tenant-env-configuration
  credsSecret:
    name: subpath-tenant-secret
  exposeServices:
    console: true
    minio: true
  features:
    domains:
      console: https://ns-1.minio-x1/console/subpath/
      minio:
        - https://ns-1.minio-x1
  image: miniodev/minio:subpath
  imagePullSecret: { }
  mountPath: /export
  pools:
    - affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: v1.min.io/tenant
                    operator: In
                    values:
                      - subpath-tenant
                  - key: v1.min.io/pool
                    operator: In
                    values:
                      - pool-0
              topologyKey: kubernetes.io/hostname
      name: pool-0
      resources: { }
      runtimeClassName: ""
      servers: 4
      volumeClaimTemplate:
        metadata:
          name: data
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: "68719476736"
          storageClassName: standard
      volumesPerServer: 4
  requestAutoCert: true
  users:
    - name: subpath-tenant-user-0

2. Create an ingress controller with the subpath

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ns-1-ingress
  namespace: ns-1
  labels:
    app: console
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/proxy-body-size: 5120g
spec:
  rules:
    - host: ns-1.minio-x1
      http:
        paths:
          - pathType: Prefix
            path: "/console/subpath/(.*)"
            backend:
              service:
                name: subpath-tenant-console
                port:
                  number: 9443
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: minio
                port:
                  number: 443

3. visit https://ns-1.minio-x1/console/subpath/

In all cases:

• Assets will load
• API calls will work
• Websockets will work

Fixes #1908
Fixes #2045
Fixes #2149
Fixes #2188
Fixes #2483
Fixes #2766
Fixes #2774
Fixes #2775

[allanrogerr]

Vanilla nginx
Im facing this open build/index.html: file does not exist. Any tips?

[bexsoft]

There is an issue while trying to create a bucket. API returns 404 while fetching API.
Tested with provided steps

[bexsoft]

LGTM, Issue is related to a misconfiguration in nginx, fixed and it worked.

[polaris-phecda]

@dvaldivia I observe that your modification depends on the rewrite configuration of Nginx. Is subpath configuration supported when I directly access the console?

[cesnietor]

Just posterity, the way the env are set didn't work so I had to do it like:

CI=true MINIO_BROWSER_REDIRECT_URL=http://localhost:8000/console/subpath/ MINIO_SERVER_URL=http://localhost:9000 ./minio server --console-address ":9090" ~/Data

Note that there are no ;
Same nginx config shared above worked.

[septatrix]

This still feels very fragile or at least poorly documented. I played around with different combinations of slashes for MINIO_SERVER_URL, MINIO_BROWSER_REDIRECT_URL, nginx location and nginx proxy_pass until I finally got it working.
I just used the sample config from the docs Configure NGINX Proxy for MinIO Server which did not work. Not sure if this PR tried to resolve that and failed or if the documentation simply needs to be updated but the current config as documented does not work for me. Furthermore, the documentation does not mention MINIO_BROWSER_REDIRECT_URL and MINIO_SERVER_URL which might also have been a cause for the problems on my side as I had no clue whether or not they require a trailing slash.

Should I open a new issue for that and if yes, is this a problem of the console which can be made more robust (e.g. I think :9001//api/v1/login were not handled) or an issue with the documentation (which should be adjusted such that path like the double-slash should never need to be handled by the console)?

---

PS: May final configuration is as follows

server {
    ...
    location /console/ {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-NginX-Proxy true;

        # This is necessary to pass the correct IP to be hashed
        real_ip_header X-Real-IP;

        proxy_connect_timeout 300;

        # To support websockets in MinIO versions released after January 2023
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        chunked_transfer_encoding off;

        proxy_pass http://127.0.0.1:7001/;
    }
}

services:
  minio:
    image: quay.io/minio/minio:RELEASE.2023-06-29T05-12-28Z
    command: server --address ":7000" --console-address ":7001" /data
    ports:
      - "127.0.0.1:7000:7000"
      - "127.0.0.1:7001:7001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      MINIO_SERVER_URL: https://s3.example.com/
      MINIO_BROWSER_REDIRECT_URL: https://s3.example.com/console/
    ...

[ravindk89]

minio/docs#865

We have an issue to document the updates to subpath behavior, but that is somewhat distinct from using either of those envvars - which last I checked, were mostly necessary for ensuring the Console can correctly connect to the MinIO Server over specific hostnames.

[ravindk89]

To put a finer point on it - this is fragile/poorly documented, primarily because NGINX is not our product. We do need to make improvements and further clarify where to use the envvars in question, but we also cannot promise that our boilerplate NGINX configuration will work in all possible scenarios. We have to assume the implementer has access to NGINX expertise to figure out the gaps.