Joe Tsai <******@****.***> 1503528984 -0700

```sh
export MINIO_CERT_PASSWD=<PASSWORD>
```

The default OpenSSL format for private encrypted keys is PKCS-8, but MinIO only supports PKCS-1. An RSA key that has been formatted with PKCS-8 can be converted to PKCS-1 using the following command:

```sh
openssl rsa -in private-pkcs8-key.key -aes256 -passout pass:PASSWORD -out private.key
```

  // can have their pods stopped for an update at any given time. The update
  // starts by stopping at most 30% of those DaemonSet pods and then brings
  // up new DaemonSet pods in their place. Once the new pods are available,
  // it then proceeds onto other DaemonSet pods, thus ensuring that at least
  // 70% of original number of DaemonSet pods are available at all times during
  // the update.

  // given RuntimeClass. For more details, see
  //  https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/
  // +optional
  optional Overhead overhead = 3;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.

  * “kubectl run” now produces Deployments (instead of ReplicationControllers) and
Jobs (instead of Pods) by default.

message JobSpec {
  // Specifies the maximum desired number of pods the job should
  // run at any given time. The actual number of pods running in steady state will
  // be less than this number when ((.spec.completions - .status.successful) < .spec.parallelism),
  // i.e. when the work left to do is less than max parallelism.
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
  // +optional

- **Cluster Lifecycle**
  - [alpha] Ensure critical cluster infrastructure pods (Heapster, DNS, etc.) can schedule by evicting regular pods when necessary to make the critical pods schedule. ([docs](http://kubernetes.io/docs/admin/rescheduler/#guaranteed-scheduling-of-critical-add-on-pods)) ([kubernetes/features#62](https://github.com/kubernetes/enhancements/issues/62))

  - [beta] StatefulSets allow workloads that require persistent identity or per-instance storage to be created and managed on Kubernetes. ([docs](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/)) ([kubernetes/features#137](https...

- Familiarity with [MinIO deployment process on Kubernetes](https://min.io/docs/minio/kubernetes/upstream/operations/installation.html).

- Kubernetes cluster with `kubectl` configured.

- Acquire TLS certificates, either from a CA or [create self-signed certificates](https://min.io/docs/minio/kubernetes/upstream/operations/network-encryption.html).

    - If excluded, ignore the pod and return prevResult
1. Setup redirect rules for the pods:
    - Get the port list from pods definition, as well as annotations.
    - Setup iptables with required port list: `nsenter --net=<k8s pod netns> /opt/cni/bin/istio-iptables ...`. Following conditions will prevent the redirect rules to be setup in the pods: