fix tls termination

deploy/minio-tenant/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: minio-cert
+  namespace: minio-tenant
+spec:
+  secretName: minio-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  commonName: s3.minio.panic.haus
+  dnsNames:
+    - s3.minio.panic.haus
+    - console.minio.panic.haus

deploy/minio-tenant/ingress.yaml

@@ -6,8 +6,6 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: nginx
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
 spec:
   rules:
     - host: s3.minio.panic.haus
@@ -19,7 +17,7 @@ spec:
               service:
                 name: minio
                 port:
-                  number: 443
+                  number: 9000
     - host: console.minio.panic.haus
       http:
         paths:
@@ -27,9 +25,9 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: panic-minio-console
+                name: minio-console
                 port:
-                  number: 9443
+                  number: 9001
   tls:
     - hosts:
         - s3.minio.panic.haus

deploy/minio-tenant/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - namespace.yaml
   - secret.yaml
   - tenant.yaml
+  - certificate.yaml
   - ingress.yaml
   - svc-minio.yaml
   - svc-minio-console.yaml

deploy/minio-tenant/secret.yaml

@@ -7,8 +7,6 @@ stringData:
   config.env: |-
     export MINIO_ROOT_USER="minio"
     export MINIO_ROOT_PASSWORD="minio123"
-    export MINIO_STORAGE_CLASS_STANDARD="EC:2"
-    export MINIO_SERVER_URL="https://s3.minio.panic.haus"
 type: Opaque
 ---
 apiVersion: v1

deploy/minio-tenant/tenant.yaml

@@ -10,6 +10,9 @@ metadata:
   name: panic-minio
   namespace: minio-tenant
 spec:
+  requestAutoCert: false
+  externalCertSecret:
+    - name: minio-tls
   exposeServices: {}
   imagePullPolicy: IfNotPresent
   certConfig: {}
@@ -17,7 +20,6 @@ spec:
     name: storage-configuration
   env: []
   externalCaCertSecret: []
-  externalCertSecret: []
   externalClientCertSecrets: []
   features:
     bucketDNS: false
@@ -27,7 +29,8 @@ spec:
   mountPath: /export
   podManagementPolicy: Parallel
   pools:
-  - affinity:
+    - name: pool-0
+      affinity:
         nodeAffinity: {}
         podAffinity: {}
         podAntiAffinity: {}
@@ -41,7 +44,6 @@ spec:
         runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
-    name: pool-0
       nodeSelector: {}
       resources: {}
       securityContext:
@@ -67,7 +69,6 @@ spec:
         status: {}
       volumesPerServer: 1
   priorityClassName: ""
-  requestAutoCert: true
   serviceAccountName: ""
   serviceMetadata:
     consoleServiceAnnotations: {}