echo "Enabling versioning for '$BUCKET'" ${MC} version enable myminio/$BUCKET elif [ $VERSIONING = false ] ; then echo "Suspending versioning for '$BUCKET'" ${MC} version suspend myminio/$BUCKET fi else echo "Bucket '$BUCKET' versioning unchanged." fi # At this point, the bucket should exist, skip checking for existence # Set policy on the bucket echo "Setting policy of bucket '$BUCKET' to '$POLICY'." ${MC} policy set $POLICY myminio/$BUCKET } # Try connecting to MinIO instance {{- if .Values.tls.enabled...

echo "Enabling versioning for '$BUCKET'" ${MC} version enable myminio/$BUCKET elif [ $VERSIONING = false ] ; then echo "Suspending versioning for '$BUCKET'" ${MC} version suspend myminio/$BUCKET fi else echo "Bucket '$BUCKET' versioning unchanged." fi # At this point, the bucket should exist, skip checking for existence # Set policy on the bucket echo "Setting policy of bucket '$BUCKET' to '$POLICY'." ${MC} policy set $POLICY myminio/$BUCKET } # Try connecting to MinIO instance {{- if .Values.tls.enabled...

echo "Enabling versioning for '$BUCKET'" ${MC} version enable myminio/$BUCKET elif [ $VERSIONING = false ] ; then echo "Suspending versioning for '$BUCKET'" ${MC} version suspend myminio/$BUCKET fi else echo "Bucket '$BUCKET' versioning unchanged." fi # At this point, the bucket should exist, skip checking for existence # Set policy on the bucket echo "Setting policy of bucket '$BUCKET' to '$POLICY'." ${MC} policy set $POLICY myminio/$BUCKET } # Try connecting to Minio instance {{- if .Values.tls.enabled...

echo "Enabling versioning for '$BUCKET'" ${MC} version enable myminio/$BUCKET elif [ $VERSIONING = false ] ; then echo "Suspending versioning for '$BUCKET'" ${MC} version suspend myminio/$BUCKET fi else echo "Bucket '$BUCKET' versioning unchanged." fi # At this point, the bucket should exist, skip checking for existence # Set policy on the bucket echo "Setting policy of bucket '$BUCKET' to '$POLICY'." ${MC} policy set $POLICY myminio/$BUCKET } # Try connecting to MinIO instance {{- if .Values.tls.enabled...

```
export MINIO_IDENTITY_OPENID_CLAIM_NAME=groups
```

and add relevant policies on MinIO using `mc admin policy create myminio/ <group_name> group-access.json`

## Explore Further

- [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html)

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    # include /etc/nginx/conf.d/*.conf;

    upstream minio {
        server minio1:9000;
        server minio2:9000;
        server minio3:9000;
        server minio4:9000;
    }

    # main minio
    server {
        listen       9000;
        listen  [::]:9000;

    keepalive_timeout  65;

    # include /etc/nginx/conf.d/*.conf;

    upstream minio {
        server minio1:9000;
        server minio2:9000;
        server minio3:9000;
        server minio4:9000;
    }

    upstream console {
        ip_hash;
        server minio1:9001;
        server minio2:9001;
        server minio3:9001;
        server minio4:9001;
    }

    server {

    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;

    # include /etc/nginx/conf.d/*.conf;

    upstream minio {
        server site1-minio1:9000;
        server site1-minio2:9000;
        server site1-minio3:9000;
        server site1-minio4:9000;
    }

    server {
        listen       9001;
        listen  [::]:9001;

    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;

    # include /etc/nginx/conf.d/*.conf;

    upstream minio {
        server site2-minio1:9000;
        server site2-minio2:9000;
        server site2-minio3:9000;
        server site2-minio4:9000;
    }

    server {
        listen       9002;
        listen  [::]:9002;

The MinIO TLS STS API can be configured via MinIO's standard configuration API (i.e. using `mc admin config set/get`). Further, it can be configured via the following environment variables:

```
mc admin config set myminio identity_tls --env
KEY:
identity_tls  enable X.509 TLS certificate SSO support

ARGS:
MINIO_IDENTITY_TLS_SKIP_VERIFY  (on|off)    trust client certificates without verification. Defaults to "off" (verify)
```