HTTPS not working for operator console when deployed with Helm chart

[MichaelGehling]

Expected Behavior

When I install minio via helm chart from https://operator.min.io/, I would expect an easy way to make HTTPS working for the operator console.

Current Behavior

1. Currently, the template for the ingress controller (console-ingress.yaml) contains hardcoded http as the target port of the console.
2. Additionally, the values.yaml does not give any hint how the tls-certificates volume must be configured and mounted, so that the console works properly via https.

Possible Solution

1. Provide a configuration value to switch between "http" and "https" in the ingress controller template (console-ingress.yaml)
2. Extend in the values.yaml the volumes and volumeMounts sections with the proper configuration (commented if not wanted as default). Here is the configuration that worked for me:

volumes:
- name: tmp
emptyDir: {}
# This is crucial for HTTPS
- name: tls-certificates
projected:
defaultMode: 420
sources:
- secret:
items:
- key: public.crt
path: public.crt
- key: public.crt
path: CAs/public.crt
- key: private.key
path: private.key
- key: tls.crt
path: tls.crt
- key: tls.crt
path: CAs/tls.crt
- key: tls.key
path: tls.key
name: console-tls
optional: true

volumeMounts:
- name: tmp
readOnly: false
mountPath: /tmp/certs/CAs
# This is crucial for HTTPS
- name: tls-certificates
readOnly: true
mountPath: /tmp/certs

Context

I must use HTTPS for cluster internal communication.
It was pretty hard to figure out how to do it for the minio operator console!

To mount the volumes, it can be done via a custom-values.yaml, but finding the correct configuration was a hassle.

For changing the ingress controller to target the https port instead of the http port, I had to add a patch command after the deployment in my deplyoment script.
Here it is for anybody with the same problem:
kubectl patch ingress minio-operator-console --type=json -p='[{"op": "replace", "path": "/spec/rules/0/http/paths/0/backend/service/port/name", "value": "https"}]' -n minio-operator

Your Environment

• Version used (minio-operator): v5.0.12
• Environment name and version: Kubernetes v1.26.7

[cniackz]

There is a PR coming that may fix this issue

#2026

[dvaldivia]

could you elaborate further? I believe by setting .Values.tenant.certificate.requestAutoCert or Values.tenant.certificate.externalCertSecret the right port name is selected on the chart

[cniackz]

I think I see the issue now:

  rules:
    - host: {{ .Values.console.ingress.host }}
      http:
        paths:
          - path: {{ .Values.console.ingress.path }}
            pathType: {{ .Values.console.ingress.pathType }}
            backend:
              service:
                name: "console"
                port:
                  name: http <------- here

We are indeed hardcoding service.port.name to http. I would rather use service.port.number as that will allow and give flexibility to pick between HTTPs or HTTP with single field. For example, in my testing, operator can use HTTP by using the port number:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minio-operator
  namespace: minio-operator
spec:
  rules:
    - host: "minio.operator"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: console
                port:
                  number: 9090

While at the same time, tenant can use HTTPS by using port number as well:

spec:
  tls:
    - hosts:
        - minio.tenant-lite.svc.cluster.local
        - minio.tenant-lite
      secretName: myminio-tls
  rules:
    - host: minio.tenant-lite.svc.cluster.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: minio
                port:
                  number: 443
    - host: minio.tenant-lite
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myminio-console
                port:
                  number: 9443

So in conclusion, I will look the way to change from service.port.name to service.port.number to fix this issue. Documentation regarding the port type can be found at: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules