</details>

### Chạy ứng dụng

Chạy server như sau:

<div class="termy">

```console
$ uvicorn main:app --reload

INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)
INFO:     Started reloader process [28720]
INFO:     Started server process [28722]
INFO:     Waiting for application startup.
INFO:     Application startup complete.

		},
		config.PolicyOPASubSys: {
			Key:         config.PolicyOPASubSys,
			Description: "[DEPRECATED - use `policy_plugin` instead] enable external OPA for policy enforcement",
		},
	}

	config.RegisterHelpDeprecatedSubSys(deprecatedHelpKVMap)
}

var (
	// globalServerConfig server config.
	globalServerConfig   config.Config

  var client = clientTestRule.newClient()

  @StartStop
  private val server = MockWebServer()

  @BeforeEach
  fun setUp() {
    // Default after JDK 14, but we are avoiding tests that assume special setup.
    // System.setProperty("jdk.tls.client.enableSessionTicketExtension", "true")
    // System.setProperty("jdk.tls.server.enableSessionTicketExtension", "true")

    platform.assumeJdk9()
  }

  @Test

    Executors::class.java.getMethod("newVirtualThreadPerTaskExecutor").invoke(null) as ExecutorService

  @Test
  fun testRequest() {
    server.enqueue(MockResponse())

    val request = Request(server.url("/"))

    client.newCall(request).execute().use {
      assertThat(it.code).isEqualTo(200)
    }
  }

  @Test
  fun testIfSupported() {

# How to secure access to MinIO on Kubernetes with TLS [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

This document explains how to configure MinIO server with TLS certificates on Kubernetes.

## 1. Prerequisites

- Familiarity with [MinIO deployment process on Kubernetes](https://docs.min.io/community/minio-object-store/operations/deployments/kubernetes.html).

- Kubernetes cluster with `kubectl` configured.

   *
   *  * A stale connection. The request was made on a reused connection and that reused connection
   *    has since been closed by the server.
   *  * A client timeout (HTTP 408).
   *  * A authorization challenge (HTTP 401 and 407) that is satisfied by the [Authenticator].
   *  * A retryable server failure (HTTP 503 with a `Retry-After: 0` response header).
   *  * A misdirected request (HTTP 421) on a coalesced connection.
   */

  @BeforeEach
  fun setup() {
    server.enqueue(MockResponse())

    client =
      clientTestRule
        .newClientBuilder()
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),
          handshakeCertificates.trustManager,
        ).hostnameVerifier(RecordingHostnameVerifier())
        .build()
    server.useHttps(handshakeCertificates.sslSocketFactory())

        // Create a buffer representing a valid DFS referral response
        // Need to include space for actual string data
        int stringDataStart = 28; // After the referral structure
        String testPath = "\\server\\share";
        byte[] pathBytes = testPath.getBytes(java.nio.charset.StandardCharsets.UTF_16LE);
        int bufferSize = stringDataStart + pathBytes.length + 2; // +2 for null terminator

        return NtlmContext.NTLMSSP_OID.equals(mechanism);
    }

    /**
     * Computes the 24 byte ANSI password hash given the 8 byte server challenge.
     *
     * @param tc the CIFS context
     * @param chlng the server challenge
     * @return the hash for the given challenge
     * @throws GeneralSecurityException if a security error occurs

version: '3.7'

# Settings and configurations that are common for all containers
x-minio-common: &minio-common
  image: quay.io/minio/minio:${JOB_NAME}
  command: server --console-address ":9001" http://minio{1...4}/cdata{1...2}
  expose:
    - "9000"
    - "9001"
  environment:
    MINIO_CI_CD: "on"
    MINIO_ROOT_USER: "minio"
    MINIO_ROOT_PASSWORD: "minio123"
    MINIO_COMPRESSION_ENABLE: "on"
    MINIO_COMPRESSION_MIME_TYPES: "*"