# How to secure access to MinIO on Kubernetes with TLS [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

This document explains how to configure MinIO server with TLS certificates on Kubernetes.

## 1. Prerequisites

- Familiarity with [MinIO deployment process on Kubernetes](https://docs.min.io/community/minio-object-store/operations/deployments/kubernetes.html).

- Kubernetes cluster with `kubectl` configured.

java.util.List listDirs(java.io.File); private void setExecutablePermiss(java.io.File); private boolean isWindows(); private boolean deleteDir(java.io.File); public void unzip(java.io.File, java.io.File) throws java.io.IOException; public void copyInputStream(java.io.InputStream, java.io.OutputStream) throws java.io.IOException; } org/apache/maven/wrapper/Logger.class package org.apache.maven.wrapper; public synchronized class Logger { private static final boolean VERBOSE; static void <clinit>(); public...

Anand Babu (AB) Periasamy <ab@min.io> Anand Babu (AB) Periasamy <******@****.***>
Anand Babu (AB) Periasamy <ab@min.io> <******@****.***>
Anis Elleuch <******@****.***>
Frederick F. Kautz IV <fkautz@min.io> <******@****.***>
Harshavardhana <harsha@min.io> <******@****.***>
Harshavardhana <harsha@min.io> <******@****.***>
Harshavardhana <harsha@min.io>

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package bytes

import (
	"errors"
	"io"
	"unicode/utf8"
)

// A Reader implements the [io.Reader], [io.ReaderAt], [io.WriterTo], [io.Seeker],
// [io.ByteScanner], and [io.RuneScanner] interfaces by reading from
// a byte slice.
// Unlike a [Buffer], a Reader is read-only and supports seeking.

node-role.kubernetes.io/ingress: platform annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # kubernetes.io/ingress.allow-http: "false" # kubernetes.io/ingress.global-static-ip-name: "" # nginx.ingress.kubernetes.io/secure-backends: "true" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 path: / hosts: - console.minio-example.local tls: [] # - secretName: chart-example-tls # hosts: # - chart-example.local ##...

node-role.kubernetes.io/ingress: platform annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # kubernetes.io/ingress.allow-http: "false" # kubernetes.io/ingress.global-static-ip-name: "" # nginx.ingress.kubernetes.io/secure-backends: "true" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 path: / hosts: - console.minio-example.local tls: [] # - secretName: chart-example-tls # hosts: # - chart-example.local ##...

consoleIngress: enabled: false ingressClassName: ~ labels: {} # node-role.kubernetes.io/ingress: platform annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # kubernetes.io/ingress.allow-http: "false" # kubernetes.io/ingress.global-static-ip-name: "" # nginx.ingress.kubernetes.io/secure-backends: "true" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 path: / hosts: - console.minio-example.local tls:...

node-role.kubernetes.io/ingress: platform annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # kubernetes.io/ingress.allow-http: "false" # kubernetes.io/ingress.global-static-ip-name: "" # nginx.ingress.kubernetes.io/secure-backends: "true" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 path: / hosts: - console.minio-example.local tls: [] # - secretName: chart-example-tls # hosts: # - chart-example.local ##...

### Source Code

filename | sha512 hash
-------- | -----------
[kubernetes.tar.gz](https://dl.k8s.io/v1.28.15/kubernetes.tar.gz) | 8e6efde16d8d5afac89242b7312bdf9c44aaeedce72549cc8cf69b26fe351d460e6ad2155fb74ba65208430c1ee26e22036639a412b5a027f9ba30f3176050c6

1T00:00:00Z"},"dillon-svcacct-1":{"parent":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","accessKey":"dillon-svcacct-1","secretKey":"dillon-svcacct-1","groups":["cn=projecta,ou=groups,ou=swengg,dc=min,dc=io","cn=projectb,ou=groups,ou=swengg,dc=min,dc=io"],"claims":{"accessKey":"dillon-svcacct-1","ldapActualUser":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","ldapUser":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","ldapUsername":"dillon","parent":"uid=dillon,ou=people,ou=swengg,dc=min,dc=io","sa-...