rm -rf /tmp/ldap{1..4}
rm -rf /tmp/ldap1{1..4}

if [ ! -f ./mc ]; then
	wget --quiet -O mc https://dl.minio.io/client/mc/release/linux-amd64/mc &&
		chmod +x mc
fi

mc -v

# Start LDAP server
echo "Copying docs/distributed/samples/bootstrap-complete.ldif => minio-iam-testing/ldap/50-bootstrap.ldif"
cp docs/distributed/samples/bootstrap-complete.ldif minio-iam-testing/ldap/50-bootstrap.ldif || exit 1
cd ./minio-iam-testing

# How to secure access to MinIO on Kubernetes with TLS [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

This document explains how to configure MinIO server with TLS certificates on Kubernetes.

## 1. Prerequisites

- Familiarity with [MinIO deployment process on Kubernetes](https://docs.min.io/community/minio-object-store/operations/deployments/kubernetes.html).

- Kubernetes cluster with `kubectl` configured.

### Server Binaries

filename | sha512 hash
-------- | -----------
[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.12/kubernetes-server-linux-amd64.tar.gz) | cd65a2f717635583ab12dc9dd2cda6a5d4d479b8b46e38e95b0d9b84355236d6f64e3a1fb7dd62f6429d51a7f33518c9b76ce6fcdc8d934a7ae317af1c4c226c

        - 'https://server4-pool1:9000/mnt/disk{1...4}/'
  -
        - 'https://server-example-pool2:9000/mnt/disk{1...4}/'
        - 'https://server1-pool2:9000/mnt/disk{1...4}/'
        - 'https://server3-pool2:9000/mnt/disk{1...4}/'
        - 'https://server4-pool2:9000/mnt/disk{1...4}/'

options:
  ftp: # settings for MinIO to act as an ftp server
        address: ':8021'
        passive-port-range: '30000-40000'

        serverAddress = InetAddress.getByName("192.168.1.100");
        registration = new WitnessRegistration("\\\\server\\share", serverAddress, WitnessServiceType.FILE_SERVER_WITNESS);
    }

    @Test
    void testRegistrationCreation() {
        assertNotNull(registration.getRegistrationId());
        assertEquals("\\\\server\\share", registration.getShareName());
        assertEquals(serverAddress, registration.getServerAddress());

   *
   *  * A stale connection. The request was made on a reused connection and that reused connection
   *    has since been closed by the server.
   *  * A client timeout (HTTP 408).
   *  * A authorization challenge (HTTP 401 and 407) that is satisfied by the [Authenticator].
   *  * A retryable server failure (HTTP 503 with a `Retry-After: 0` response header).
   *  * A misdirected request (HTTP 421) on a coalesced connection.
   */

          // TLSv1.2 Events
          // Produced ClientHello handshake message
          // Consuming ServerHello handshake message
          // Consuming server Certificate handshake message
          // Consuming server CertificateStatus handshake message
          // Found trusted certificate
          // Consuming ECDH ServerKeyExchange handshake message
          // Consuming ServerHelloDone handshake message

            // Parse only URL
            String[] args = { "smb://server/share/test.txt" };
            for (int ai = 0; ai < args.length; ai++) {
                if (!args[ai].startsWith("-")) {
                    t.url = args[ai];
                }
            }

            assertEquals("smb://server/share/test.txt", t.url, "URL should be parsed");

        @CsvSource({ "'ncacn_np:\\\\server[endpoint=\\pipe\\srvsvc]', ncacn_np, server, '\\pipe\\srvsvc'",
                "'ncacn_np:server[\\pipe\\srvsvc]', ncacn_np, server, '\\pipe\\srvsvc'",
                "'ncacn_np:[\\pipe\\srvsvc]', ncacn_np, 127.0.0.1, '\\pipe\\srvsvc'",
                "'ncacn_np:server[endpoint=\\pipe\\srvsvc]', ncacn_np, server, '\\pipe\\srvsvc'" })

        assertTrue(written > 0);
    }

    @Test
    @DisplayName("Constructor with NetbiosNames should initialize properly")
    void testConstructorWithNetbiosNames() {
        when(mockCalledName.getName()).thenReturn("SERVER");
        when(mockCalledName.getNameType()).thenReturn(0x20);
        when(mockCalledName.getScope()).thenReturn(null);

        when(mockCallingName.getName()).thenReturn("CLIENT");