# How to secure access to MinIO on Kubernetes with TLS [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

This document explains how to configure MinIO server with TLS certificates on Kubernetes.

## 1. Prerequisites

- Familiarity with [MinIO deployment process on Kubernetes](https://docs.min.io/community/minio-object-store/operations/deployments/kubernetes.html).

- Kubernetes cluster with `kubectl` configured.

version: '3.7'

# Settings and configurations that are common for all containers
x-minio-common: &minio-common
  image: quay.io/minio/minio:${JOB_NAME}
  command: server --console-address ":9001" edata{1...4}
  expose:
    - "9000"
    - "9001"
  environment:
    MINIO_CI_CD: "on"
    MINIO_ROOT_USER: "minio"
    MINIO_ROOT_PASSWORD: "minio123"
    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
  healthcheck:

    }

    /**
     * Checks if the given address is one of the configured WINS servers.
     *
     * @param svr the server address to check
     * @return whether the given address is a WINS server
     */
    protected boolean isWINS(final InetAddress svr) {
        for (int i = 0; svr != null && i < this.transportContext.getConfig().getWinsServers().length; i++) {

    }

    synchronized void insert(final String path, final DfsReferral dr) {
        int s1, s2;
        String server, share, key;

        if (DISABLED) {
            return;
        }

        s1 = path.indexOf('\\', 1);
        s2 = path.indexOf('\\', s1 + 1);
        server = path.substring(1, s1);
        share = path.substring(s1 + 1, s2);

  var client = clientTestRule.newClient()

  @StartStop
  private val server = MockWebServer()

  @BeforeEach
  fun setUp() {
    // Default after JDK 14, but we are avoiding tests that assume special setup.
    // System.setProperty("jdk.tls.client.enableSessionTicketExtension", "true")
    // System.setProperty("jdk.tls.server.enableSessionTicketExtension", "true")

    platform.assumeJdk9()
  }

  @Test

### Server Binaries

filename | sha512 hash
-------- | -----------
[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.12/kubernetes-server-linux-amd64.tar.gz) | cd65a2f717635583ab12dc9dd2cda6a5d4d479b8b46e38e95b0d9b84355236d6f64e3a1fb7dd62f6429d51a7f33518c9b76ce6fcdc8d934a7ae317af1c4c226c

    @Test
    @DisplayName("handleDFSReferral handles null referral and empty path")
    void handleDfsReferralNullAndEmpty() {
        when(locator.handleDFSReferral(null, "")).thenReturn("smb://server/share/");
        assertEquals("smb://server/share/", locator.handleDFSReferral(null, ""));
        verify(locator).handleDFSReferral(null, "");
        verifyNoMoreInteractions(locator);
    }

rm -rf /tmp/ldap{1..4}
rm -rf /tmp/ldap1{1..4}

if [ ! -f ./mc ]; then
	wget --quiet -O mc https://dl.minio.io/client/mc/release/linux-amd64/mc &&
		chmod +x mc
fi

mc -v

# Start LDAP server
echo "Copying docs/distributed/samples/bootstrap-complete.ldif => minio-iam-testing/ldap/50-bootstrap.ldif"
cp docs/distributed/samples/bootstrap-complete.ldif minio-iam-testing/ldap/50-bootstrap.ldif || exit 1
cd ./minio-iam-testing

        assertTrue(written > 0);
    }

    @Test
    @DisplayName("Constructor with NetbiosNames should initialize properly")
    void testConstructorWithNetbiosNames() {
        when(mockCalledName.getName()).thenReturn("SERVER");
        when(mockCalledName.getNameType()).thenReturn(0x20);
        when(mockCalledName.getScope()).thenReturn(null);

        when(mockCallingName.getName()).thenReturn("CLIENT");

        serverAddress = InetAddress.getByName("192.168.1.100");
        registration = new WitnessRegistration("\\\\server\\share", serverAddress, WitnessServiceType.FILE_SERVER_WITNESS);
    }

    @Test
    void testRegistrationCreation() {
        assertNotNull(registration.getRegistrationId());
        assertEquals("\\\\server\\share", registration.getShareName());
        assertEquals(serverAddress, registration.getServerAddress());