Compare commits
11 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
b8bca9d2fe | ||
|
a6ccae52d2 | ||
|
bdfa6dc9bf | ||
|
|
6eb5731eb5 | ||
|
|
953574f7a3 | ||
|
|
8ec6d695de | ||
|
47274817fa | ||
|
|
3b123c6182 | ||
|
|
d7f72e0c41 | ||
|
|
c0bf9c5da8 | ||
|
|
16a6524b11 |
18
go.mod
18
go.mod
@@ -15,19 +15,19 @@ require (
|
||||
github.com/gorilla/websocket v1.4.2
|
||||
github.com/jessevdk/go-flags v1.4.0
|
||||
github.com/minio/cli v1.22.0
|
||||
github.com/minio/kes v0.10.1
|
||||
github.com/minio/mc v0.0.0-20200725183142-90d22b271f60
|
||||
github.com/minio/minio v0.0.0-20200725154241-abbf6ce6ccf8
|
||||
github.com/minio/minio-go/v7 v7.0.2-0.20200722162308-e0105ca08252
|
||||
github.com/minio/operator v0.0.0-20200730044813-c2895a5065a1
|
||||
github.com/minio/kes v0.11.0
|
||||
github.com/minio/mc v0.0.0-20200808005614-7e52c104bee1
|
||||
github.com/minio/minio v0.0.0-20200808024306-2a9819aff876
|
||||
github.com/minio/minio-go/v7 v7.0.5-0.20200807085956-d7db33ea7618
|
||||
github.com/minio/operator v0.0.0-20200806194125-c2ff646f4af1
|
||||
github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
|
||||
github.com/stretchr/testify v1.6.1
|
||||
github.com/unrolled/secure v1.0.7
|
||||
golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899
|
||||
golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de
|
||||
golang.org/x/net v0.0.0-20200707034311-ab3426394381
|
||||
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
|
||||
gopkg.in/yaml.v2 v2.3.0
|
||||
k8s.io/api v0.18.0
|
||||
k8s.io/apimachinery v0.18.0
|
||||
k8s.io/client-go v0.18.0
|
||||
k8s.io/api v0.18.6
|
||||
k8s.io/apimachinery v0.18.6
|
||||
k8s.io/client-go v0.18.6
|
||||
)
|
||||
|
||||
75
go.sum
75
go.sum
@@ -270,6 +270,8 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
|
||||
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
|
||||
github.com/golang/protobuf v1.4.0 h1:oOuy+ugB+P/kBdUnG5QaMXSIyJ1q38wWSojYCb3z5VQ=
|
||||
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
|
||||
github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
|
||||
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
|
||||
github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=
|
||||
github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
|
||||
github.com/gomodule/redigo v2.0.0+incompatible h1:K/R+8tc58AaqLkqG2Ol3Qk+DR/TlNuhuh457pBFPtt0=
|
||||
@@ -284,6 +286,8 @@ github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg=
|
||||
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
|
||||
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/google/go-cmp v0.4.1 h1:/exdXoGamhu5ONeUJH0deniYLWYvQwW66yvlfiiKTu0=
|
||||
github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
|
||||
github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
@@ -348,6 +352,8 @@ github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
|
||||
github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
|
||||
github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
|
||||
github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
|
||||
github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
|
||||
github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
|
||||
github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
|
||||
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
|
||||
github.com/hashicorp/raft v1.1.2 h1:oxEL5DDeurYxLd3UbcY/hccgSPhLLpiBZ1YxtWEq59c=
|
||||
@@ -363,6 +369,8 @@ github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
|
||||
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
|
||||
github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q=
|
||||
github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
|
||||
github.com/imdario/mergo v0.3.10 h1:6q5mVkdH/vYmqngx7kZQTjJ5HRsx+ImorDIEQ+beJgc=
|
||||
github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
|
||||
github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf h1:WfD7VjIE6z8dIvMsI4/s+1qr5EL+zoIGev1BQj1eoJ8=
|
||||
github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf/go.mod h1:hyb9oH7vZsitZCiBt0ZvifOrB+qc8PS5IiilCIb87rg=
|
||||
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
|
||||
@@ -455,24 +463,28 @@ github.com/minio/cli v1.22.0 h1:VTQm7lmXm3quxO917X3p+el1l0Ca5X3S4PM2ruUYO68=
|
||||
github.com/minio/cli v1.22.0/go.mod h1:bYxnK0uS629N3Bq+AOZZ+6lwF77Sodk4+UL9vNuXhOY=
|
||||
github.com/minio/highwayhash v1.0.0 h1:iMSDhgUILCr0TNm8LWlSjF8N0ZIj2qbO8WHp6Q/J2BA=
|
||||
github.com/minio/highwayhash v1.0.0/go.mod h1:xQboMTeM9nY9v/LlAOxFctujiv5+Aq2hR5dxBpaMbdc=
|
||||
github.com/minio/kes v0.10.1 h1:f+WDJdNHNMf1xE6BbjtCLUyh671weSCQ30uynoCPl78=
|
||||
github.com/minio/kes v0.10.1/go.mod h1:mTF1Bv8YVEtQqF/B7Felp4tLee44Pp+dgI0rhCvgNg8=
|
||||
github.com/minio/mc v0.0.0-20200725183142-90d22b271f60 h1:LevaZ33nx+rUzRsuU7rVvqXUP7VCu2BQanhITw4Z9rA=
|
||||
github.com/minio/mc v0.0.0-20200725183142-90d22b271f60/go.mod h1:Hvnyrb/NMM+pJ53JO/J3jxGtwPDYJh7K6c1D+RR2h2g=
|
||||
github.com/minio/kes v0.11.0 h1:8ma6OCVSxKT50b1uYXLJro3m7PmZtCLxBaTddQexI5k=
|
||||
github.com/minio/kes v0.11.0/go.mod h1:mTF1Bv8YVEtQqF/B7Felp4tLee44Pp+dgI0rhCvgNg8=
|
||||
github.com/minio/mc v0.0.0-20200808005614-7e52c104bee1 h1:OrcFWsUIzKoXeIXVReZ7AryDtbPBLtkjDDOBnuU9RWY=
|
||||
github.com/minio/mc v0.0.0-20200808005614-7e52c104bee1/go.mod h1:OGP9+cwQ174WKwZTgJOIFstVv19CH0wdSDZSG6NyTuE=
|
||||
github.com/minio/md5-simd v1.1.0 h1:QPfiOqlZH+Cj9teu0t9b1nTBfPbyTl16Of5MeuShdK4=
|
||||
github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=
|
||||
github.com/minio/minio v0.0.0-20200722004956-c43da3005ae8/go.mod h1:Eu2KC2p+vW03rnYY/6R/D+QduPB7/j4kBaVA/EDLjWM=
|
||||
github.com/minio/minio v0.0.0-20200723003940-b9be841fd222 h1:+XFGpEsqmA033nDX8LtjyPZy01Shivf6E2OL67WoGiE=
|
||||
github.com/minio/minio v0.0.0-20200723003940-b9be841fd222/go.mod h1:Eu2KC2p+vW03rnYY/6R/D+QduPB7/j4kBaVA/EDLjWM=
|
||||
github.com/minio/minio v0.0.0-20200725154241-abbf6ce6ccf8 h1:H0tUGnx1zkZCtqQp3LuV2GNjOasrJ9gmvlwOeDJDvzI=
|
||||
github.com/minio/minio v0.0.0-20200725154241-abbf6ce6ccf8/go.mod h1:NBWtYp4t5pt3TmbpW7FHChY6ZCs8n/gTRxZCF0mCcn8=
|
||||
github.com/minio/minio v0.0.0-20200807001021-adcaa6f9de88 h1:v2mCqNx6N02jcYHWjMPHdTN9+ogxEN9L+cCQJ+8j2AU=
|
||||
github.com/minio/minio v0.0.0-20200807001021-adcaa6f9de88/go.mod h1:r+PkhkMRxudvboO0Wa7F7nMiDfI8Rz1HZSza0uIhtMU=
|
||||
github.com/minio/minio v0.0.0-20200808024306-2a9819aff876 h1:e5114Mb8Evzt1QsA8b6PrXZ1KqBLts0CokpKeU1DV2U=
|
||||
github.com/minio/minio v0.0.0-20200808024306-2a9819aff876/go.mod h1:r+PkhkMRxudvboO0Wa7F7nMiDfI8Rz1HZSza0uIhtMU=
|
||||
github.com/minio/minio-go/v7 v7.0.1/go.mod h1:dJ80Mv2HeGkYLH1sqS/ksz07ON6csH3S6JUMSQ2zAns=
|
||||
github.com/minio/minio-go/v7 v7.0.2-0.20200722162308-e0105ca08252 h1:V2JkMDoSmEIhRcMJwX3qeJVOzy1B5bHpHbZaQu77vbs=
|
||||
github.com/minio/minio-go/v7 v7.0.2-0.20200722162308-e0105ca08252/go.mod h1:dJ80Mv2HeGkYLH1sqS/ksz07ON6csH3S6JUMSQ2zAns=
|
||||
github.com/minio/operator v0.0.0-20200730044813-c2895a5065a1 h1:cTgvRgFBUVxbnxhQUioT2T7SH0M7AyvO7dDX32yKPGw=
|
||||
github.com/minio/operator v0.0.0-20200730044813-c2895a5065a1/go.mod h1:RLhFkLcL65qmrgUQJHrRwb1Lb4yHgD/DfjNENY2WNXg=
|
||||
github.com/minio/selfupdate v0.3.0 h1:1qfaZscU3hWwX1cF5m5Dov8Z5aZNvPHk9LROzIkas1k=
|
||||
github.com/minio/selfupdate v0.3.0/go.mod h1:b8ThJzzH7u2MkF6PcIra7KaXO9Khf6alWPvMSyTDCFM=
|
||||
github.com/minio/minio-go/v7 v7.0.2 h1:P/7wFd4KrRBHVo7AKdcqO+9ReoS+XpMjfRFoE5quH0E=
|
||||
github.com/minio/minio-go/v7 v7.0.2/go.mod h1:dJ80Mv2HeGkYLH1sqS/ksz07ON6csH3S6JUMSQ2zAns=
|
||||
github.com/minio/minio-go/v7 v7.0.3/go.mod h1:TA0CQCjJZHM5SJj9IjqR0NmpmQJ6bCbXifAJ3mUU6Hw=
|
||||
github.com/minio/minio-go/v7 v7.0.5-0.20200807085956-d7db33ea7618 h1:8iTb0TFs6kDGAUnhI/s2QCZOYcSTtYmY9dF+Cbc0WJo=
|
||||
github.com/minio/minio-go/v7 v7.0.5-0.20200807085956-d7db33ea7618/go.mod h1:CSt2ETZNs+bIIhWTse0mcZKZWMGrFU7Er7RR0TmkDYk=
|
||||
github.com/minio/operator v0.0.0-20200806194125-c2ff646f4af1 h1:ijXSIPjn/GZx1+RW1HQpScoifLNr8lVw5LNVKxysMWg=
|
||||
github.com/minio/operator v0.0.0-20200806194125-c2ff646f4af1/go.mod h1:V8RL9xPw3C9rC7DuEy7JHeSiOlTWvQhZvh2+YySBFbk=
|
||||
github.com/minio/selfupdate v0.3.1 h1:BWEFSNnrZVMUWXbXIgLDNDjbejkmpAmZvy/nCz1HlEs=
|
||||
github.com/minio/selfupdate v0.3.1/go.mod h1:b8ThJzzH7u2MkF6PcIra7KaXO9Khf6alWPvMSyTDCFM=
|
||||
github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU=
|
||||
github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
|
||||
github.com/minio/simdjson-go v0.1.5-0.20200303142138-b17fe061ea37 h1:pDeao6M5AEd8hwTtGmE0pVKomlL56JFRa5SiXDZAuJE=
|
||||
@@ -589,13 +601,19 @@ github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR
|
||||
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
github.com/rs/cors v1.7.0 h1:+88SsELBHx5r+hZ8TCkggzSstaWNbDvThkVK8H6f9ik=
|
||||
github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
|
||||
github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
|
||||
github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
|
||||
github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
|
||||
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
|
||||
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
|
||||
github.com/secure-io/sio-go v0.3.0 h1:QKGb6rGJeiExac9wSWxnWPYo8O8OFN7lxXQvHshX6vo=
|
||||
github.com/secure-io/sio-go v0.3.0/go.mod h1:D3KmXgKETffyYxBdFRN+Hpd2WzhzqS0EQwT3XWsAcBU=
|
||||
github.com/secure-io/sio-go v0.3.1 h1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=
|
||||
github.com/secure-io/sio-go v0.3.1/go.mod h1:+xbkjDzPjwh4Axd07pRKSNriS9SCiYksWnZqdnfpQxs=
|
||||
github.com/shirou/gopsutil v2.20.3-0.20200314133625-53cec6b37e6a+incompatible h1:YiKUe2ZOmfpDBH4OSyxwkx/mjNqHHnNhOtZ2mPyRme8=
|
||||
github.com/shirou/gopsutil v2.20.3-0.20200314133625-53cec6b37e6a+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
|
||||
github.com/shirou/gopsutil v2.20.6+incompatible h1:P37G9YH8M4vqkKcwBosp+URN5O8Tay67D2MbR361ioY=
|
||||
github.com/shirou/gopsutil v2.20.6+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
|
||||
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
|
||||
github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
|
||||
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
|
||||
@@ -660,6 +678,7 @@ github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0
|
||||
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 h1:eY9dn8+vbi4tKz5Qo6v2eYzo7kUS51QINcR5jNpbZS8=
|
||||
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
|
||||
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
go.etcd.io/bbolt v1.3.5 h1:XAzx9gjCb0Rxj7EoqcClPD1d5ZBxZJk0jbuoPHenBt0=
|
||||
go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
|
||||
go.etcd.io/etcd/v3 v3.3.0-rc.0.0.20200707003333-58bb8ae09f8e h1:HZQLoe71Q24wVyDrGBRcVuogx32U+cPlcm/WoSLUI6c=
|
||||
@@ -700,10 +719,13 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
|
||||
golang.org/x/crypto v0.0.0-20191117063200-497ca9f6d64f/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 h1:/Tl7pH94bvbAAHBdZJT947M/+gp0+CqQXDtMRC0fseo=
|
||||
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899 h1:DZhuSZLsGlFL4CmhA8BcRA0mnthyA/nZ00AqCUo7vHg=
|
||||
golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de h1:ikNHVSjEfnvz6sxdSPCaPt572qowuyMDMJLLm3Db3ig=
|
||||
golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
||||
@@ -714,6 +736,8 @@ golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHl
|
||||
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
|
||||
golang.org/x/mod v0.2.0 h1:KU7oHjnv3XNWfa5COkzUifxZmxp1TyI7ImMXqFxLwvQ=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
@@ -737,6 +761,7 @@ golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLL
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=
|
||||
golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
|
||||
golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
|
||||
golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
@@ -752,6 +777,7 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58 h1:8gQV6CLnAEikrhgkHFbMAEha
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4BrLOthgV7252N8V+FwY=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@@ -779,12 +805,13 @@ golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7w
|
||||
golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
|
||||
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae h1:Ih9Yo4hSPImZOpfGuA4bR/ORKTAbhZo2AbWNRCnevdo=
|
||||
golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200720211630-cb9d2d5c5666 h1:gVCS+QOncANNPlmlO1AhlU3oxs4V9z+gTtPwIk3p2N8=
|
||||
golang.org/x/sys v0.0.0-20200720211630-cb9d2d5c5666/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200806125547-5acd03effb82 h1:6cBnXxYO+CiRVrChvCosSv7magqTPbyAgz1M8iOv5wM=
|
||||
golang.org/x/sys v0.0.0-20200806125547-5acd03effb82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
@@ -819,6 +846,8 @@ golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtn
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200425043458-8463f397d07c h1:iHhCR0b26amDCiiO+kBguKZom9aMF+NrFxh9zeKR/XU=
|
||||
golang.org/x/tools v0.0.0-20200425043458-8463f397d07c/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20200724172932-b5fc9d354d99 h1:OHn441rq5CeM5r1xJ0OmY7lfdTvnedi6k+vQiI7G9b8=
|
||||
golang.org/x/tools v0.0.0-20200724172932-b5fc9d354d99/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
|
||||
@@ -851,6 +880,8 @@ google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miE
|
||||
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
|
||||
google.golang.org/protobuf v1.22.0 h1:cJv5/xdbk1NnMPR1VP9+HU6gupuG9MLBoH1r6RHZ2MY=
|
||||
google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||
google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
|
||||
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
|
||||
gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d h1:TxyelI5cVkbREznMhfzycHdkp5cLA7DpE+GKjSslYhM=
|
||||
gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
|
||||
@@ -909,12 +940,12 @@ honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWh
|
||||
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
|
||||
honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
|
||||
k8s.io/api v0.18.0 h1:lwYk8Vt7rsVTwjRU6pzEsa9YNhThbmbocQlKvNBB4EQ=
|
||||
k8s.io/api v0.18.0/go.mod h1:q2HRQkfDzHMBZL9l/y9rH63PkQl4vae0xRT+8prbrK8=
|
||||
k8s.io/apimachinery v0.18.0 h1:fuPfYpk3cs1Okp/515pAf0dNhL66+8zk8RLbSX+EgAE=
|
||||
k8s.io/apimachinery v0.18.0/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
|
||||
k8s.io/client-go v0.18.0 h1:yqKw4cTUQraZK3fcVCMeSa+lqKwcjZ5wtcOIPnxQno4=
|
||||
k8s.io/client-go v0.18.0/go.mod h1:uQSYDYs4WhVZ9i6AIoEZuwUggLVEF64HOD37boKAtF8=
|
||||
k8s.io/api v0.18.6 h1:osqrAXbOQjkKIWDTjrqxWQ3w0GkKb1KA1XkUGHHYpeE=
|
||||
k8s.io/api v0.18.6/go.mod h1:eeyxr+cwCjMdLAmr2W3RyDI0VvTawSg/3RFFBEnmZGI=
|
||||
k8s.io/apimachinery v0.18.6 h1:RtFHnfGNfd1N0LeSrKCUznz5xtUP1elRGvHJbL3Ntag=
|
||||
k8s.io/apimachinery v0.18.6/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
|
||||
k8s.io/client-go v0.18.6 h1:I+oWqJbibLSGsZj8Xs8F0aWVXJVIoUHWaaJV3kUN/Zw=
|
||||
k8s.io/client-go v0.18.6/go.mod h1:/fwtGLjYMS1MaM5oi+eXhKwG+1UHidUEXRh6cNsdO0Q=
|
||||
k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
|
||||
k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
|
||||
k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
|
||||
@@ -922,8 +953,6 @@ k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
|
||||
k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
|
||||
k8s.io/klog/v2 v2.3.0 h1:WmkrnW7fdrm0/DMClc+HIxtftvxVIPAhlVwMQo5yLco=
|
||||
k8s.io/klog/v2 v2.3.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
|
||||
k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c h1:/KUFqjjqAcY4Us6luF5RDNZ16KJtb49HfR3ZHB9qYXM=
|
||||
k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
|
||||
k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6 h1:Oh3Mzx5pJ+yIumsAD0MOECPVeXsVot0UkiaCGVyfGQY=
|
||||
k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
|
||||
k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89 h1:d4vVOjXm687F1iLSP2q3lyPPuyvTUt3aVoBpi2DqRsU=
|
||||
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
serviceAccountName: console-sa
|
||||
containers:
|
||||
- name: console
|
||||
image: minio/console:v0.3.7
|
||||
image: minio/console:v0.3.10
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
args:
|
||||
- server
|
||||
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
serviceAccountName: console-sa
|
||||
containers:
|
||||
- name: console
|
||||
image: minio/console:v0.3.7
|
||||
image: minio/console:v0.3.10
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
env:
|
||||
- name: CONSOLE_OPERATOR_MODE
|
||||
|
||||
@@ -45,8 +45,8 @@ type CreateTenantRequest struct {
|
||||
// enable console
|
||||
EnableConsole *bool `json:"enable_console,omitempty"`
|
||||
|
||||
// enable ssl
|
||||
EnableSsl *bool `json:"enable_ssl,omitempty"`
|
||||
// enable tls
|
||||
EnableTLS *bool `json:"enable_tls,omitempty"`
|
||||
|
||||
// encryption
|
||||
Encryption *EncryptionConfiguration `json:"encryption,omitempty"`
|
||||
|
||||
@@ -26,7 +26,6 @@ import (
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/strfmt"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/go-openapi/validate"
|
||||
)
|
||||
|
||||
// EncryptionConfiguration encryption configuration
|
||||
@@ -38,7 +37,7 @@ type EncryptionConfiguration struct {
|
||||
Aws *AwsConfiguration `json:"aws,omitempty"`
|
||||
|
||||
// client
|
||||
Client *EncryptionConfigurationClient `json:"client,omitempty"`
|
||||
Client *KeyPairConfiguration `json:"client,omitempty"`
|
||||
|
||||
// gemalto
|
||||
Gemalto *GemaltoConfiguration `json:"gemalto,omitempty"`
|
||||
@@ -46,11 +45,8 @@ type EncryptionConfiguration struct {
|
||||
// image
|
||||
Image string `json:"image,omitempty"`
|
||||
|
||||
// master key
|
||||
MasterKey string `json:"master_key,omitempty"`
|
||||
|
||||
// server
|
||||
Server *EncryptionConfigurationServer `json:"server,omitempty"`
|
||||
Server *KeyPairConfiguration `json:"server,omitempty"`
|
||||
|
||||
// vault
|
||||
Vault *VaultConfiguration `json:"vault,omitempty"`
|
||||
@@ -193,139 +189,3 @@ func (m *EncryptionConfiguration) UnmarshalBinary(b []byte) error {
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
|
||||
// EncryptionConfigurationClient encryption configuration client
|
||||
//
|
||||
// swagger:model EncryptionConfigurationClient
|
||||
type EncryptionConfigurationClient struct {
|
||||
|
||||
// crt
|
||||
// Required: true
|
||||
Crt *string `json:"crt"`
|
||||
|
||||
// key
|
||||
// Required: true
|
||||
Key *string `json:"key"`
|
||||
}
|
||||
|
||||
// Validate validates this encryption configuration client
|
||||
func (m *EncryptionConfigurationClient) Validate(formats strfmt.Registry) error {
|
||||
var res []error
|
||||
|
||||
if err := m.validateCrt(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if err := m.validateKey(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if len(res) > 0 {
|
||||
return errors.CompositeValidationError(res...)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *EncryptionConfigurationClient) validateCrt(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("client"+"."+"crt", "body", m.Crt); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *EncryptionConfigurationClient) validateKey(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("client"+"."+"key", "body", m.Key); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalBinary interface implementation
|
||||
func (m *EncryptionConfigurationClient) MarshalBinary() ([]byte, error) {
|
||||
if m == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return swag.WriteJSON(m)
|
||||
}
|
||||
|
||||
// UnmarshalBinary interface implementation
|
||||
func (m *EncryptionConfigurationClient) UnmarshalBinary(b []byte) error {
|
||||
var res EncryptionConfigurationClient
|
||||
if err := swag.ReadJSON(b, &res); err != nil {
|
||||
return err
|
||||
}
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
|
||||
// EncryptionConfigurationServer encryption configuration server
|
||||
//
|
||||
// swagger:model EncryptionConfigurationServer
|
||||
type EncryptionConfigurationServer struct {
|
||||
|
||||
// crt
|
||||
// Required: true
|
||||
Crt *string `json:"crt"`
|
||||
|
||||
// key
|
||||
// Required: true
|
||||
Key *string `json:"key"`
|
||||
}
|
||||
|
||||
// Validate validates this encryption configuration server
|
||||
func (m *EncryptionConfigurationServer) Validate(formats strfmt.Registry) error {
|
||||
var res []error
|
||||
|
||||
if err := m.validateCrt(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if err := m.validateKey(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if len(res) > 0 {
|
||||
return errors.CompositeValidationError(res...)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *EncryptionConfigurationServer) validateCrt(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("server"+"."+"crt", "body", m.Crt); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *EncryptionConfigurationServer) validateKey(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("server"+"."+"key", "body", m.Key); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalBinary interface implementation
|
||||
func (m *EncryptionConfigurationServer) MarshalBinary() ([]byte, error) {
|
||||
if m == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return swag.WriteJSON(m)
|
||||
}
|
||||
|
||||
// UnmarshalBinary interface implementation
|
||||
func (m *EncryptionConfigurationServer) UnmarshalBinary(b []byte) error {
|
||||
var res EncryptionConfigurationServer
|
||||
if err := swag.ReadJSON(b, &res); err != nil {
|
||||
return err
|
||||
}
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
|
||||
98
models/key_pair_configuration.go
Normal file
98
models/key_pair_configuration.go
Normal file
@@ -0,0 +1,98 @@
|
||||
// Code generated by go-swagger; DO NOT EDIT.
|
||||
|
||||
// This file is part of MinIO Console Server
|
||||
// Copyright (c) 2020 MinIO, Inc.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
//
|
||||
|
||||
package models
|
||||
|
||||
// This file was generated by the swagger tool.
|
||||
// Editing this file might prove futile when you re-run the swagger generate command
|
||||
|
||||
import (
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/strfmt"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/go-openapi/validate"
|
||||
)
|
||||
|
||||
// KeyPairConfiguration key pair configuration
|
||||
//
|
||||
// swagger:model keyPairConfiguration
|
||||
type KeyPairConfiguration struct {
|
||||
|
||||
// crt
|
||||
// Required: true
|
||||
Crt *string `json:"crt"`
|
||||
|
||||
// key
|
||||
// Required: true
|
||||
Key *string `json:"key"`
|
||||
}
|
||||
|
||||
// Validate validates this key pair configuration
|
||||
func (m *KeyPairConfiguration) Validate(formats strfmt.Registry) error {
|
||||
var res []error
|
||||
|
||||
if err := m.validateCrt(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if err := m.validateKey(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if len(res) > 0 {
|
||||
return errors.CompositeValidationError(res...)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *KeyPairConfiguration) validateCrt(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("crt", "body", m.Crt); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *KeyPairConfiguration) validateKey(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("key", "body", m.Key); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalBinary interface implementation
|
||||
func (m *KeyPairConfiguration) MarshalBinary() ([]byte, error) {
|
||||
if m == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return swag.WriteJSON(m)
|
||||
}
|
||||
|
||||
// UnmarshalBinary interface implementation
|
||||
func (m *KeyPairConfiguration) UnmarshalBinary(b []byte) error {
|
||||
var res KeyPairConfiguration
|
||||
if err := swag.ReadJSON(b, &res); err != nil {
|
||||
return err
|
||||
}
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
@@ -26,7 +26,6 @@ import (
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/strfmt"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/go-openapi/validate"
|
||||
)
|
||||
|
||||
// TLSConfiguration tls configuration
|
||||
@@ -34,24 +33,22 @@ import (
|
||||
// swagger:model tlsConfiguration
|
||||
type TLSConfiguration struct {
|
||||
|
||||
// crt
|
||||
// Required: true
|
||||
Crt *string `json:"crt"`
|
||||
// console
|
||||
Console *KeyPairConfiguration `json:"console,omitempty"`
|
||||
|
||||
// key
|
||||
// Required: true
|
||||
Key *string `json:"key"`
|
||||
// minio
|
||||
Minio *KeyPairConfiguration `json:"minio,omitempty"`
|
||||
}
|
||||
|
||||
// Validate validates this tls configuration
|
||||
func (m *TLSConfiguration) Validate(formats strfmt.Registry) error {
|
||||
var res []error
|
||||
|
||||
if err := m.validateCrt(formats); err != nil {
|
||||
if err := m.validateConsole(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if err := m.validateKey(formats); err != nil {
|
||||
if err := m.validateMinio(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
@@ -61,19 +58,37 @@ func (m *TLSConfiguration) Validate(formats strfmt.Registry) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *TLSConfiguration) validateCrt(formats strfmt.Registry) error {
|
||||
func (m *TLSConfiguration) validateConsole(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("crt", "body", m.Crt); err != nil {
|
||||
return err
|
||||
if swag.IsZero(m.Console) { // not required
|
||||
return nil
|
||||
}
|
||||
|
||||
if m.Console != nil {
|
||||
if err := m.Console.Validate(formats); err != nil {
|
||||
if ve, ok := err.(*errors.Validation); ok {
|
||||
return ve.ValidateName("console")
|
||||
}
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *TLSConfiguration) validateKey(formats strfmt.Registry) error {
|
||||
func (m *TLSConfiguration) validateMinio(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("key", "body", m.Key); err != nil {
|
||||
return err
|
||||
if swag.IsZero(m.Minio) { // not required
|
||||
return nil
|
||||
}
|
||||
|
||||
if m.Minio != nil {
|
||||
if err := m.Minio.Validate(formats); err != nil {
|
||||
if ve, ok := err.(*errors.Validation); ok {
|
||||
return ve.ValidateName("minio")
|
||||
}
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
|
||||
@@ -53,6 +53,9 @@ type VaultConfiguration struct {
|
||||
|
||||
// status
|
||||
Status *VaultConfigurationStatus `json:"status,omitempty"`
|
||||
|
||||
// tls
|
||||
TLS *VaultConfigurationTLS `json:"tls,omitempty"`
|
||||
}
|
||||
|
||||
// Validate validates this vault configuration
|
||||
@@ -71,6 +74,10 @@ func (m *VaultConfiguration) Validate(formats strfmt.Registry) error {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if err := m.validateTLS(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if len(res) > 0 {
|
||||
return errors.CompositeValidationError(res...)
|
||||
}
|
||||
@@ -122,6 +129,24 @@ func (m *VaultConfiguration) validateStatus(formats strfmt.Registry) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *VaultConfiguration) validateTLS(formats strfmt.Registry) error {
|
||||
|
||||
if swag.IsZero(m.TLS) { // not required
|
||||
return nil
|
||||
}
|
||||
|
||||
if m.TLS != nil {
|
||||
if err := m.TLS.Validate(formats); err != nil {
|
||||
if ve, ok := err.(*errors.Validation); ok {
|
||||
return ve.ValidateName("tls")
|
||||
}
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalBinary interface implementation
|
||||
func (m *VaultConfiguration) MarshalBinary() ([]byte, error) {
|
||||
if m == nil {
|
||||
@@ -245,3 +270,41 @@ func (m *VaultConfigurationStatus) UnmarshalBinary(b []byte) error {
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
|
||||
// VaultConfigurationTLS vault configuration TLS
|
||||
//
|
||||
// swagger:model VaultConfigurationTLS
|
||||
type VaultConfigurationTLS struct {
|
||||
|
||||
// ca
|
||||
Ca string `json:"ca,omitempty"`
|
||||
|
||||
// crt
|
||||
Crt string `json:"crt,omitempty"`
|
||||
|
||||
// key
|
||||
Key string `json:"key,omitempty"`
|
||||
}
|
||||
|
||||
// Validate validates this vault configuration TLS
|
||||
func (m *VaultConfigurationTLS) Validate(formats strfmt.Registry) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalBinary interface implementation
|
||||
func (m *VaultConfigurationTLS) MarshalBinary() ([]byte, error) {
|
||||
if m == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return swag.WriteJSON(m)
|
||||
}
|
||||
|
||||
// UnmarshalBinary interface implementation
|
||||
func (m *VaultConfigurationTLS) UnmarshalBinary(b []byte) error {
|
||||
var res VaultConfigurationTLS
|
||||
if err := swag.ReadJSON(b, &res); err != nil {
|
||||
return err
|
||||
}
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
|
||||
81
models/zone_toleration_seconds.go
Normal file
81
models/zone_toleration_seconds.go
Normal file
@@ -0,0 +1,81 @@
|
||||
// Code generated by go-swagger; DO NOT EDIT.
|
||||
|
||||
// This file is part of MinIO Console Server
|
||||
// Copyright (c) 2020 MinIO, Inc.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
//
|
||||
|
||||
package models
|
||||
|
||||
// This file was generated by the swagger tool.
|
||||
// Editing this file might prove futile when you re-run the swagger generate command
|
||||
|
||||
import (
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/strfmt"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/go-openapi/validate"
|
||||
)
|
||||
|
||||
// ZoneTolerationSeconds TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
|
||||
//
|
||||
// swagger:model zoneTolerationSeconds
|
||||
type ZoneTolerationSeconds struct {
|
||||
|
||||
// seconds
|
||||
// Required: true
|
||||
Seconds *int64 `json:"seconds"`
|
||||
}
|
||||
|
||||
// Validate validates this zone toleration seconds
|
||||
func (m *ZoneTolerationSeconds) Validate(formats strfmt.Registry) error {
|
||||
var res []error
|
||||
|
||||
if err := m.validateSeconds(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if len(res) > 0 {
|
||||
return errors.CompositeValidationError(res...)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *ZoneTolerationSeconds) validateSeconds(formats strfmt.Registry) error {
|
||||
|
||||
if err := validate.Required("seconds", "body", m.Seconds); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalBinary interface implementation
|
||||
func (m *ZoneTolerationSeconds) MarshalBinary() ([]byte, error) {
|
||||
if m == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return swag.WriteJSON(m)
|
||||
}
|
||||
|
||||
// UnmarshalBinary interface implementation
|
||||
func (m *ZoneTolerationSeconds) UnmarshalBinary(b []byte) error {
|
||||
var res ZoneTolerationSeconds
|
||||
if err := swag.ReadJSON(b, &res); err != nil {
|
||||
return err
|
||||
}
|
||||
*m = res
|
||||
return nil
|
||||
}
|
||||
@@ -75,8 +75,8 @@ type ZoneTolerationsItems0 struct {
|
||||
// Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
|
||||
Operator string `json:"operator,omitempty"`
|
||||
|
||||
// TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
|
||||
TolerationSeconds int64 `json:"tolerationSeconds,omitempty"`
|
||||
// toleration seconds
|
||||
TolerationSeconds *ZoneTolerationSeconds `json:"tolerationSeconds,omitempty"`
|
||||
|
||||
// Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
|
||||
Value string `json:"value,omitempty"`
|
||||
@@ -84,6 +84,33 @@ type ZoneTolerationsItems0 struct {
|
||||
|
||||
// Validate validates this zone tolerations items0
|
||||
func (m *ZoneTolerationsItems0) Validate(formats strfmt.Registry) error {
|
||||
var res []error
|
||||
|
||||
if err := m.validateTolerationSeconds(formats); err != nil {
|
||||
res = append(res, err)
|
||||
}
|
||||
|
||||
if len(res) > 0 {
|
||||
return errors.CompositeValidationError(res...)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *ZoneTolerationsItems0) validateTolerationSeconds(formats strfmt.Registry) error {
|
||||
|
||||
if swag.IsZero(m.TolerationSeconds) { // not required
|
||||
return nil
|
||||
}
|
||||
|
||||
if m.TolerationSeconds != nil {
|
||||
if err := m.TolerationSeconds.Validate(formats); err != nil {
|
||||
if ve, ok := err.(*errors.Validation); ok {
|
||||
return ve.ValidateName("tolerationSeconds")
|
||||
}
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
|
||||
@@ -9,12 +9,14 @@ import (
|
||||
"github.com/minio/kes"
|
||||
)
|
||||
|
||||
type Identity = kes.Identity
|
||||
|
||||
type TLSProxyHeader struct {
|
||||
ClientCert string `yaml:"cert,omitempty"`
|
||||
}
|
||||
|
||||
type TLSProxy struct {
|
||||
Identities *[]kes.Identity `yaml:"identities,omitempty"`
|
||||
Identities *[]Identity `yaml:"identities,omitempty"`
|
||||
Header *TLSProxyHeader `yaml:"header,omitempty"`
|
||||
}
|
||||
|
||||
@@ -25,8 +27,8 @@ type TLS struct {
|
||||
}
|
||||
|
||||
type Policy struct {
|
||||
Paths []string `yaml:"paths,omitempty"`
|
||||
Identities []kes.Identity `yaml:"identities,omitempty"`
|
||||
Paths []string `yaml:"paths,omitempty"`
|
||||
Identities []Identity `yaml:"identities,omitempty"`
|
||||
}
|
||||
|
||||
type Expiry struct {
|
||||
@@ -120,7 +122,7 @@ type Keys struct {
|
||||
|
||||
type ServerConfig struct {
|
||||
Addr string `yaml:"address,omitempty"`
|
||||
Root kes.Identity `yaml:"root,omitempty"`
|
||||
Root Identity `yaml:"root,omitempty"`
|
||||
TLS TLS `yaml:"tls,omitempty"`
|
||||
Policies map[string]Policy `yaml:"policy,omitempty"`
|
||||
Cache Cache `yaml:"cache,omitempty"`
|
||||
|
||||
@@ -33,10 +33,10 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/minio/console/pkg/kes"
|
||||
kes2 "github.com/minio/kes"
|
||||
"gopkg.in/yaml.v2"
|
||||
"k8s.io/apimachinery/pkg/api/resource"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
|
||||
@@ -178,7 +178,7 @@ func getTenantScheme(mi *operator.Tenant) string {
|
||||
return scheme
|
||||
}
|
||||
|
||||
func getTenantAdminClient(ctx context.Context, client K8sClient, namespace, tenantName, serviceName, scheme string) (*madmin.AdminClient, error) {
|
||||
func getTenantAdminClient(ctx context.Context, client K8sClient, namespace, tenantName, serviceName, scheme string, insecure bool) (*madmin.AdminClient, error) {
|
||||
// get admin credentials from secret
|
||||
creds, err := client.getSecret(ctx, namespace, fmt.Sprintf("%s-secret", tenantName), metav1.GetOptions{})
|
||||
if err != nil {
|
||||
@@ -194,11 +194,7 @@ func getTenantAdminClient(ctx context.Context, client K8sClient, namespace, tena
|
||||
log.Println("tenant's secret doesn't contain secretkey")
|
||||
return nil, errorGeneric
|
||||
}
|
||||
service, err := client.getService(ctx, namespace, serviceName, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
mAdmin, pErr := NewAdminClient(scheme+"://"+net.JoinHostPort(service.Spec.ClusterIP, strconv.Itoa(operator.MinIOPort)), string(accessKey), string(secretkey))
|
||||
mAdmin, pErr := NewAdminClientWithInsecure(scheme+"://"+net.JoinHostPort(serviceName, strconv.Itoa(operator.MinIOPort)), string(accessKey), string(secretkey), insecure)
|
||||
if pErr != nil {
|
||||
return nil, pErr.Cause
|
||||
}
|
||||
@@ -214,13 +210,6 @@ func getTenant(ctx context.Context, operatorClient OperatorClient, namespace, te
|
||||
}
|
||||
|
||||
func getTenantInfo(tenant *operator.Tenant) *models.Tenant {
|
||||
var instanceCount int64
|
||||
var volumeCount int64
|
||||
for _, zone := range tenant.Spec.Zones {
|
||||
instanceCount = instanceCount + int64(zone.Servers)
|
||||
volumeCount = volumeCount + int64(zone.Servers*zone.VolumesPerServer)
|
||||
}
|
||||
|
||||
var zones []*models.Zone
|
||||
|
||||
var totalSize int64
|
||||
@@ -407,7 +396,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
}
|
||||
envrionmentVariables = append(envrionmentVariables, corev1.EnvVar{
|
||||
Name: "MINIO_STORAGE_CLASS_STANDARD",
|
||||
Value: fmt.Sprintf("%d", tenantReq.ErasureCodingParity),
|
||||
Value: fmt.Sprintf("EC:%d", tenantReq.ErasureCodingParity),
|
||||
})
|
||||
}
|
||||
|
||||
@@ -477,26 +466,26 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
}
|
||||
}
|
||||
|
||||
// operator request AutoCert feature
|
||||
encryption := false
|
||||
if tenantReq.EnableSsl != nil {
|
||||
encryption = true
|
||||
minInst.Spec.RequestAutoCert = *tenantReq.EnableSsl
|
||||
isEncryptionAvailable := false
|
||||
if *tenantReq.EnableTLS {
|
||||
// If user request autoCert, Operator will generate certificate keypair for MinIO (server), Console (server) and KES (server and app mTLS)
|
||||
isEncryptionAvailable = true
|
||||
minInst.Spec.RequestAutoCert = *tenantReq.EnableTLS
|
||||
}
|
||||
|
||||
// User provided TLS certificates (this will take priority over autoCert)
|
||||
if tenantReq.TLS != nil && tenantReq.TLS.Crt != nil && tenantReq.TLS.Key != nil {
|
||||
encryption = true
|
||||
if !minInst.Spec.RequestAutoCert && tenantReq.TLS != nil && tenantReq.TLS.Minio != nil {
|
||||
// User provided TLS certificates for MinIO
|
||||
isEncryptionAvailable = true
|
||||
externalTLSCertificateSecretName := fmt.Sprintf("%s-instance-external-certificates", secretName)
|
||||
// disable autoCert
|
||||
minInst.Spec.RequestAutoCert = false
|
||||
|
||||
tlsCrt, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Crt)
|
||||
tlsCrt, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Minio.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
tlsKey, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Key)
|
||||
tlsKey, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Minio.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -523,223 +512,23 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
}
|
||||
}
|
||||
|
||||
if tenantReq.Encryption != nil && encryption {
|
||||
if tenantReq.Encryption != nil && isEncryptionAvailable {
|
||||
// Enable auto encryption
|
||||
minInst.Spec.Env = append(minInst.Spec.Env, corev1.EnvVar{
|
||||
Name: "MINIO_KMS_AUTO_ENCRYPTION",
|
||||
Value: "on",
|
||||
})
|
||||
|
||||
if tenantReq.Encryption.MasterKey != "" {
|
||||
// Configure MinIO to use MINIO_KMS_MASTER_KEY legacy key
|
||||
// https://docs.min.io/docs/minio-vault-legacy.html
|
||||
minInst.Spec.Env = append(minInst.Spec.Env, corev1.EnvVar{
|
||||
Name: "MINIO_KMS_MASTER_KEY",
|
||||
Value: tenantReq.Encryption.MasterKey,
|
||||
})
|
||||
} else {
|
||||
// KES configuration for Tenant instance
|
||||
minInst.Spec.KES = &operator.KESConfig{
|
||||
Image: "minio/kes:latest",
|
||||
Replicas: 1,
|
||||
Metadata: nil,
|
||||
}
|
||||
// Using custom image for KES
|
||||
if tenantReq.Encryption.Image != "" {
|
||||
minInst.Spec.KES.Image = tenantReq.Encryption.Image
|
||||
}
|
||||
// Secret to store KES server TLS certificates
|
||||
// TODO check if AutoCert it's already configured
|
||||
serverTLSCrt, err := base64.StdEncoding.DecodeString(*tenantReq.Encryption.Server.Crt)
|
||||
// KES client mTLSCertificates used by MinIO instance, only if autoCert is not enabled
|
||||
if !minInst.Spec.RequestAutoCert {
|
||||
minInst.Spec.ExternalClientCertSecret, err = getTenantExternalClientCertificates(ctx, clientset, ns, tenantReq.Encryption, secretName)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
serverTLSKey, err := base64.StdEncoding.DecodeString(*tenantReq.Encryption.Server.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
kesExternalCertificateSecretName := fmt.Sprintf("%s-kes-external-certificates", secretName)
|
||||
kesExternalCertificateSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: kesExternalCertificateSecretName,
|
||||
},
|
||||
Type: corev1.SecretTypeTLS,
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"tls.crt": serverTLSCrt,
|
||||
"tls.key": serverTLSKey,
|
||||
},
|
||||
}
|
||||
_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &kesExternalCertificateSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// External certificates used by KES
|
||||
minInst.Spec.KES.ExternalCertSecret = &operator.LocalCertificateReference{
|
||||
Name: kesExternalCertificateSecretName,
|
||||
Type: "kubernetes.io/tls",
|
||||
}
|
||||
|
||||
// Secret to store KES clients TLS certificates (mTLS authentication)
|
||||
clientTLSCrt, err := base64.StdEncoding.DecodeString(*tenantReq.Encryption.Client.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
clientTLSKey, err := base64.StdEncoding.DecodeString(*tenantReq.Encryption.Client.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
instanceExternalClientCertificateSecretName := fmt.Sprintf("%s-instance-external-client-certificates", secretName)
|
||||
instanceExternalClientCertificateSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: instanceExternalClientCertificateSecretName,
|
||||
},
|
||||
Type: corev1.SecretTypeTLS,
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"tls.crt": clientTLSCrt,
|
||||
"tls.key": clientTLSKey,
|
||||
},
|
||||
}
|
||||
_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &instanceExternalClientCertificateSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// KES client certificates used by MinIO instance
|
||||
minInst.Spec.ExternalClientCertSecret = &operator.LocalCertificateReference{
|
||||
Name: instanceExternalClientCertificateSecretName,
|
||||
Type: "kubernetes.io/tls",
|
||||
}
|
||||
// Calculate the client cert identity based on the clientTLSCrt
|
||||
h := crypto.SHA256.New()
|
||||
certificate, err := kes.ParseCertificate(clientTLSCrt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
h.Write(certificate.RawSubjectPublicKeyInfo)
|
||||
clientCrtIdentity := hex.EncodeToString(h.Sum(nil))
|
||||
// Default configuration for KES
|
||||
kesConfig := kes.ServerConfig{
|
||||
Addr: "0.0.0.0:7373",
|
||||
Root: "disabled",
|
||||
TLS: kes.TLS{
|
||||
KeyPath: "/tmp/kes/server.key",
|
||||
CertPath: "/tmp/kes/server.crt",
|
||||
},
|
||||
Policies: map[string]kes.Policy{
|
||||
"default-policy": {
|
||||
Paths: []string{
|
||||
"/v1/key/create/my-minio-key",
|
||||
"/v1/key/generate/my-minio-key",
|
||||
"/v1/key/decrypt/my-minio-key",
|
||||
},
|
||||
Identities: []kes2.Identity{
|
||||
kes2.Identity(clientCrtIdentity),
|
||||
},
|
||||
},
|
||||
},
|
||||
Cache: kes.Cache{
|
||||
Expiry: &kes.Expiry{
|
||||
Any: 5 * time.Minute,
|
||||
Unused: 20 * time.Second,
|
||||
},
|
||||
},
|
||||
Log: kes.Log{
|
||||
Error: "on",
|
||||
Audit: "off",
|
||||
},
|
||||
Keys: kes.Keys{},
|
||||
}
|
||||
// if encryption is enabled and encryption is configured to use Vault
|
||||
if tenantReq.Encryption.Vault != nil {
|
||||
// Initialize Vault Config
|
||||
kesConfig.Keys.Vault = &kes.Vault{
|
||||
Endpoint: *tenantReq.Encryption.Vault.Endpoint,
|
||||
EnginePath: tenantReq.Encryption.Vault.Engine,
|
||||
Namespace: tenantReq.Encryption.Vault.Namespace,
|
||||
Prefix: tenantReq.Encryption.Vault.Prefix,
|
||||
Status: &kes.VaultStatus{
|
||||
Ping: 10 * time.Second,
|
||||
},
|
||||
}
|
||||
// Vault AppRole credentials
|
||||
if tenantReq.Encryption.Vault.Approle != nil {
|
||||
kesConfig.Keys.Vault.AppRole = &kes.AppRole{
|
||||
EnginePath: tenantReq.Encryption.Vault.Approle.Engine,
|
||||
ID: *tenantReq.Encryption.Vault.Approle.ID,
|
||||
Secret: *tenantReq.Encryption.Vault.Approle.Secret,
|
||||
Retry: 15 * time.Second,
|
||||
}
|
||||
} else {
|
||||
return nil, errors.New("approle credentials missing for kes")
|
||||
}
|
||||
} else if tenantReq.Encryption.Aws != nil {
|
||||
// Initialize AWS
|
||||
kesConfig.Keys.Aws = &kes.Aws{
|
||||
SecretsManager: &kes.AwsSecretManager{},
|
||||
}
|
||||
// AWS basic configuration
|
||||
if tenantReq.Encryption.Aws.Secretsmanager != nil {
|
||||
kesConfig.Keys.Aws.SecretsManager.Endpoint = *tenantReq.Encryption.Aws.Secretsmanager.Endpoint
|
||||
kesConfig.Keys.Aws.SecretsManager.Region = *tenantReq.Encryption.Aws.Secretsmanager.Region
|
||||
kesConfig.Keys.Aws.SecretsManager.KmsKey = tenantReq.Encryption.Aws.Secretsmanager.Kmskey
|
||||
// AWS credentials
|
||||
if tenantReq.Encryption.Aws.Secretsmanager.Credentials != nil {
|
||||
kesConfig.Keys.Aws.SecretsManager.Login = &kes.AwsSecretManagerLogin{
|
||||
AccessKey: *tenantReq.Encryption.Aws.Secretsmanager.Credentials.Accesskey,
|
||||
SecretKey: *tenantReq.Encryption.Aws.Secretsmanager.Credentials.Secretkey,
|
||||
SessionToken: tenantReq.Encryption.Aws.Secretsmanager.Credentials.Token,
|
||||
}
|
||||
}
|
||||
}
|
||||
} else if tenantReq.Encryption.Gemalto != nil {
|
||||
// Initialize Gemalto
|
||||
kesConfig.Keys.Gemalto = &kes.Gemalto{
|
||||
KeySecure: &kes.GemaltoKeySecure{},
|
||||
}
|
||||
// Gemalto Configuration
|
||||
if tenantReq.Encryption.Gemalto.Keysecure != nil {
|
||||
kesConfig.Keys.Gemalto.KeySecure.Endpoint = *tenantReq.Encryption.Gemalto.Keysecure.Endpoint
|
||||
// Gemalto TLS configuration
|
||||
if tenantReq.Encryption.Gemalto.Keysecure.TLS != nil {
|
||||
kesConfig.Keys.Gemalto.KeySecure.TLS = &kes.GemaltoTLS{
|
||||
CAPath: *tenantReq.Encryption.Gemalto.Keysecure.TLS.Ca,
|
||||
}
|
||||
}
|
||||
// Gemalto Login
|
||||
if tenantReq.Encryption.Gemalto.Keysecure.Credentials != nil {
|
||||
kesConfig.Keys.Gemalto.KeySecure.Credentials = &kes.GemaltoCredentials{
|
||||
Token: *tenantReq.Encryption.Gemalto.Keysecure.Credentials.Token,
|
||||
Domain: *tenantReq.Encryption.Gemalto.Keysecure.Credentials.Domain,
|
||||
Retry: 15 * time.Second,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// Generate Yaml configuration for KES
|
||||
serverConfigYaml, err := yaml.Marshal(kesConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Secret to store KES server configuration
|
||||
kesConfigurationSecretName := fmt.Sprintf("%s-kes-configuration", secretName)
|
||||
kesConfigurationSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: kesConfigurationSecretName,
|
||||
},
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"server-config.yaml": serverConfigYaml,
|
||||
},
|
||||
}
|
||||
_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &kesConfigurationSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Configuration used by KES
|
||||
minInst.Spec.KES.Configuration = &corev1.LocalObjectReference{
|
||||
Name: kesConfigurationSecretName,
|
||||
}
|
||||
}
|
||||
// KES configuration for Tenant instance
|
||||
minInst.Spec.KES, err = getKESConfiguration(ctx, clientset, ns, tenantReq.Encryption, secretName, minInst.Spec.RequestAutoCert)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
@@ -747,10 +536,8 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
var consoleAccess string
|
||||
var consoleSecret string
|
||||
|
||||
enableConsole := true
|
||||
if tenantReq.EnableConsole != nil {
|
||||
enableConsole = *tenantReq.EnableConsole
|
||||
}
|
||||
//enableConsole := true
|
||||
enableConsole := *tenantReq.EnableConsole
|
||||
|
||||
if enableConsole {
|
||||
consoleSelector := fmt.Sprintf("%s-console", *tenantReq.Name)
|
||||
@@ -798,7 +585,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
return nil, err
|
||||
}
|
||||
|
||||
const consoleVersion = "minio/console:v0.3.7"
|
||||
const consoleVersion = "minio/console:v0.3.10"
|
||||
minInst.Spec.Console = &operator.ConsoleConfiguration{
|
||||
Replicas: 2,
|
||||
Image: consoleVersion,
|
||||
@@ -809,15 +596,57 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if !minInst.Spec.RequestAutoCert && tenantReq.TLS.Console != nil {
|
||||
consoleExternalTLSCertificateSecretName := fmt.Sprintf("%s-console-external-certificates", secretName)
|
||||
tlsCrt, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Console.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
tlsKey, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Console.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
consoleExternalTLSCertificateSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: consoleExternalTLSCertificateSecretName,
|
||||
},
|
||||
Type: corev1.SecretTypeTLS,
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"tls.crt": tlsCrt,
|
||||
"tls.key": tlsKey,
|
||||
},
|
||||
}
|
||||
_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &consoleExternalTLSCertificateSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Certificates used by the minio instance
|
||||
minInst.Spec.Console.ExternalCertSecret = &operator.LocalCertificateReference{
|
||||
Name: consoleExternalTLSCertificateSecretName,
|
||||
Type: "kubernetes.io/tls",
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// set the service name if provided
|
||||
if tenantReq.ServiceName != "" {
|
||||
minInst.Spec.ServiceName = tenantReq.ServiceName
|
||||
}
|
||||
// add annotations
|
||||
var annotations map[string]string
|
||||
if len(tenantReq.Annotations) > 0 {
|
||||
if minInst.Spec.Metadata == nil {
|
||||
minInst.Spec.Metadata = &metav1.ObjectMeta{}
|
||||
}
|
||||
annotations = tenantReq.Annotations
|
||||
minInst.Spec.Metadata.Annotations = annotations
|
||||
}
|
||||
// set the zones if they are provided
|
||||
for _, zone := range tenantReq.Zones {
|
||||
zone, err := parseTenantZoneRequest(zone)
|
||||
zone, err := parseTenantZoneRequest(zone, annotations)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -828,13 +657,6 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
if tenantReq.MounthPath != "" {
|
||||
minInst.Spec.Mountpath = tenantReq.MounthPath
|
||||
}
|
||||
// add annotations
|
||||
if len(tenantReq.Annotations) > 0 {
|
||||
if minInst.Spec.Metadata == nil {
|
||||
minInst.Spec.Metadata = &metav1.ObjectMeta{}
|
||||
}
|
||||
minInst.Spec.Metadata.Annotations = tenantReq.Annotations
|
||||
}
|
||||
|
||||
if err := setImageRegistry(ctx, tenantReq.ImageRegistry, clientset.CoreV1(), ns); err != nil {
|
||||
log.Println("error setting image registry secret:", err)
|
||||
@@ -1002,7 +824,7 @@ func addTenantZone(ctx context.Context, operatorClient OperatorClient, params ad
|
||||
}
|
||||
|
||||
zoneParams := params.Body
|
||||
zone, err := parseTenantZoneRequest(zoneParams)
|
||||
zone, err := parseTenantZoneRequest(zoneParams, tenant.ObjectMeta.Annotations)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -1065,15 +887,10 @@ func getTenantUsageResponse(session *models.Principal, params admin_api.GetTenan
|
||||
log.Println("error getting minioTenant:", err)
|
||||
return nil, err
|
||||
}
|
||||
minTenant.EnsureDefaults()
|
||||
tenantScheme := getTenantScheme(minTenant)
|
||||
|
||||
svcName := minTenant.Spec.ServiceName
|
||||
if svcName == "" {
|
||||
svcName = minTenant.Name
|
||||
// TODO:
|
||||
// 1 get tenant services
|
||||
// 2 filter out cluster ip svc
|
||||
}
|
||||
svcName := fmt.Sprintf("%s.%s.svc.cluster.local", minTenant.MinIOCIServiceName(), minTenant.Namespace)
|
||||
|
||||
mAdmin, err := getTenantAdminClient(
|
||||
ctx,
|
||||
@@ -1081,7 +898,8 @@ func getTenantUsageResponse(session *models.Principal, params admin_api.GetTenan
|
||||
params.Namespace,
|
||||
params.Tenant,
|
||||
svcName,
|
||||
tenantScheme)
|
||||
tenantScheme,
|
||||
true)
|
||||
if err != nil {
|
||||
log.Println("error getting tenant's admin client:", err)
|
||||
return nil, err
|
||||
@@ -1101,7 +919,7 @@ func getTenantUsageResponse(session *models.Principal, params admin_api.GetTenan
|
||||
|
||||
// parseTenantZoneRequest parse zone request and returns the equivalent
|
||||
// operator.Zone object
|
||||
func parseTenantZoneRequest(zoneParams *models.Zone) (*operator.Zone, error) {
|
||||
func parseTenantZoneRequest(zoneParams *models.Zone, annotations map[string]string) (*operator.Zone, error) {
|
||||
if zoneParams.VolumeConfiguration == nil {
|
||||
return nil, errors.New("a volume configuration must be specified")
|
||||
}
|
||||
@@ -1231,26 +1049,38 @@ func parseTenantZoneRequest(zoneParams *models.Zone) (*operator.Zone, error) {
|
||||
// parse tolerations
|
||||
tolerations := []corev1.Toleration{}
|
||||
for _, elem := range zoneParams.Tolerations {
|
||||
var tolerationSeconds *int64
|
||||
if elem.TolerationSeconds != nil {
|
||||
// elem.TolerationSeconds.Seconds is allowed to be nil
|
||||
tolerationSeconds = elem.TolerationSeconds.Seconds
|
||||
}
|
||||
|
||||
toleration := corev1.Toleration{
|
||||
Key: elem.Key,
|
||||
Operator: corev1.TolerationOperator(elem.Operator),
|
||||
Value: elem.Value,
|
||||
Effect: corev1.TaintEffect(elem.Effect),
|
||||
TolerationSeconds: &elem.TolerationSeconds,
|
||||
TolerationSeconds: tolerationSeconds,
|
||||
}
|
||||
tolerations = append(tolerations, toleration)
|
||||
}
|
||||
|
||||
zone := &operator.Zone{
|
||||
Name: zoneParams.Name,
|
||||
Servers: int32(*zoneParams.Servers),
|
||||
VolumesPerServer: *zoneParams.VolumesPerServer,
|
||||
VolumeClaimTemplate: &corev1.PersistentVolumeClaim{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "data",
|
||||
},
|
||||
Spec: volTemp,
|
||||
// Pass annotations to the volume
|
||||
vct := &corev1.PersistentVolumeClaim{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "data",
|
||||
},
|
||||
Spec: volTemp,
|
||||
}
|
||||
if len(annotations) > 0 {
|
||||
vct.ObjectMeta.Annotations = annotations
|
||||
}
|
||||
|
||||
zone := &operator.Zone{
|
||||
Name: zoneParams.Name,
|
||||
Servers: int32(*zoneParams.Servers),
|
||||
VolumesPerServer: *zoneParams.VolumesPerServer,
|
||||
VolumeClaimTemplate: vct,
|
||||
Resources: corev1.ResourceRequirements{
|
||||
Requests: resourcesRequests,
|
||||
Limits: resourcesLimits,
|
||||
@@ -1426,12 +1256,18 @@ func parseTenantZone(zone *operator.Zone) *models.Zone {
|
||||
// parse tolerations
|
||||
var tolerations models.ZoneTolerations
|
||||
for _, elem := range zone.Tolerations {
|
||||
var tolerationSecs *models.ZoneTolerationSeconds
|
||||
if elem.TolerationSeconds != nil {
|
||||
tolerationSecs = &models.ZoneTolerationSeconds{
|
||||
Seconds: elem.TolerationSeconds,
|
||||
}
|
||||
}
|
||||
toleration := &models.ZoneTolerationsItems0{
|
||||
Key: elem.Key,
|
||||
Operator: string(elem.Operator),
|
||||
Value: elem.Value,
|
||||
Effect: string(elem.Effect),
|
||||
TolerationSeconds: *elem.TolerationSeconds,
|
||||
TolerationSeconds: tolerationSecs,
|
||||
}
|
||||
tolerations = append(tolerations, toleration)
|
||||
}
|
||||
@@ -1494,3 +1330,329 @@ func parseNodeSelectorTerm(term *corev1.NodeSelectorTerm) *models.NodeSelectorTe
|
||||
}
|
||||
return &t
|
||||
}
|
||||
|
||||
func getTenantExternalClientCertificates(ctx context.Context, clientSet *kubernetes.Clientset, ns string, encryptionCfg *models.EncryptionConfiguration, secretName string) (clientCertificates *operator.LocalCertificateReference, err error) {
|
||||
instanceExternalClientCertificateSecretName := fmt.Sprintf("%s-instance-external-client-mtls-certificates", secretName)
|
||||
// If there's an error during this process we delete all KES configuration secrets
|
||||
defer func() {
|
||||
if err != nil {
|
||||
errDelete := clientSet.CoreV1().Secrets(ns).Delete(ctx, instanceExternalClientCertificateSecretName, metav1.DeleteOptions{})
|
||||
if errDelete != nil {
|
||||
log.Print(errDelete)
|
||||
}
|
||||
return
|
||||
}
|
||||
}()
|
||||
imm := true
|
||||
// Secret to store KES clients TLS mTLSCertificates (mTLS authentication)
|
||||
clientTLSCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Client.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
clientTLSKey, err := base64.StdEncoding.DecodeString(*encryptionCfg.Client.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
instanceExternalClientCertificateSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: instanceExternalClientCertificateSecretName,
|
||||
},
|
||||
Type: corev1.SecretTypeTLS,
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"tls.crt": clientTLSCrt,
|
||||
"tls.key": clientTLSKey,
|
||||
},
|
||||
}
|
||||
_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &instanceExternalClientCertificateSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// KES client mTLSCertificates used by MinIO instance
|
||||
clientCertificates = &operator.LocalCertificateReference{
|
||||
Name: instanceExternalClientCertificateSecretName,
|
||||
Type: "kubernetes.io/tls",
|
||||
}
|
||||
return clientCertificates, nil
|
||||
}
|
||||
|
||||
func getKESConfiguration(ctx context.Context, clientSet *kubernetes.Clientset, ns string, encryptionCfg *models.EncryptionConfiguration, secretName string, autoCert bool) (kesConfiguration *operator.KESConfig, err error) {
|
||||
// secrets used by the KES configuration
|
||||
instanceExternalClientCertificateSecretName := fmt.Sprintf("%s-instance-external-client-mtls-certificates", secretName)
|
||||
kesExternalCertificateSecretName := fmt.Sprintf("%s-kes-external-mtls-certificates", secretName)
|
||||
kesClientCertSecretName := fmt.Sprintf("%s-kes-mtls-certificates", secretName)
|
||||
kesConfigurationSecretName := fmt.Sprintf("%s-kes-configuration", secretName)
|
||||
// If there's an error during this process we delete all KES configuration secrets
|
||||
defer func() {
|
||||
if err != nil {
|
||||
errDelete := clientSet.CoreV1().Secrets(ns).Delete(ctx, instanceExternalClientCertificateSecretName, metav1.DeleteOptions{})
|
||||
if errDelete != nil {
|
||||
log.Print(errDelete)
|
||||
}
|
||||
errDelete = clientSet.CoreV1().Secrets(ns).Delete(ctx, kesExternalCertificateSecretName, metav1.DeleteOptions{})
|
||||
if errDelete != nil {
|
||||
log.Print(errDelete)
|
||||
}
|
||||
errDelete = clientSet.CoreV1().Secrets(ns).Delete(ctx, kesClientCertSecretName, metav1.DeleteOptions{})
|
||||
if errDelete != nil {
|
||||
log.Print(errDelete)
|
||||
}
|
||||
errDelete = clientSet.CoreV1().Secrets(ns).Delete(ctx, kesConfigurationSecretName, metav1.DeleteOptions{})
|
||||
if errDelete != nil {
|
||||
log.Print(errDelete)
|
||||
}
|
||||
return
|
||||
}
|
||||
}()
|
||||
|
||||
imm := true
|
||||
kesConfiguration = &operator.KESConfig{
|
||||
Image: "minio/kes:v0.11.0",
|
||||
Replicas: 1,
|
||||
Metadata: nil,
|
||||
}
|
||||
// Using custom image for KES
|
||||
if encryptionCfg.Image != "" {
|
||||
kesConfiguration.Image = encryptionCfg.Image
|
||||
}
|
||||
// if autoCert is enabled then Operator will generate the client certificates, calculate the client cert identity
|
||||
// and pass it to KES via the $MINIO_KES_IDENTITY variable
|
||||
clientCrtIdentity := "$MINIO_KES_IDENTITY"
|
||||
// Generate server certificates for KES only if autoCert is disabled
|
||||
if !autoCert {
|
||||
serverTLSCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Server.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
serverTLSKey, err := base64.StdEncoding.DecodeString(*encryptionCfg.Server.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Secret to store KES server TLS mTLSCertificates
|
||||
kesExternalCertificateSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: kesExternalCertificateSecretName,
|
||||
},
|
||||
Type: corev1.SecretTypeTLS,
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"tls.crt": serverTLSCrt,
|
||||
"tls.key": serverTLSKey,
|
||||
},
|
||||
}
|
||||
_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &kesExternalCertificateSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// External mTLSCertificates used by KES
|
||||
kesConfiguration.ExternalCertSecret = &operator.LocalCertificateReference{
|
||||
Name: kesExternalCertificateSecretName,
|
||||
Type: "kubernetes.io/tls",
|
||||
}
|
||||
|
||||
// Client certificate for KES used by Minio to mTLS
|
||||
clientTLSCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Client.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Calculate the client cert identity based on the clientTLSCrt
|
||||
h := crypto.SHA256.New()
|
||||
certificate, err := kes.ParseCertificate(clientTLSCrt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
h.Write(certificate.RawSubjectPublicKeyInfo)
|
||||
clientCrtIdentity = hex.EncodeToString(h.Sum(nil))
|
||||
}
|
||||
|
||||
// Default kesConfiguration for KES
|
||||
kesConfig := kes.ServerConfig{
|
||||
Addr: "0.0.0.0:7373",
|
||||
Root: "disabled",
|
||||
TLS: kes.TLS{
|
||||
KeyPath: "/tmp/kes/server.key",
|
||||
CertPath: "/tmp/kes/server.crt",
|
||||
},
|
||||
Policies: map[string]kes.Policy{
|
||||
"default-policy": {
|
||||
Paths: []string{
|
||||
"/v1/key/create/my-minio-key",
|
||||
"/v1/key/generate/my-minio-key",
|
||||
"/v1/key/decrypt/my-minio-key",
|
||||
},
|
||||
Identities: []kes.Identity{
|
||||
kes.Identity(clientCrtIdentity),
|
||||
},
|
||||
},
|
||||
},
|
||||
Cache: kes.Cache{
|
||||
Expiry: &kes.Expiry{
|
||||
Any: 5 * time.Minute,
|
||||
Unused: 20 * time.Second,
|
||||
},
|
||||
},
|
||||
Log: kes.Log{
|
||||
Error: "on",
|
||||
Audit: "off",
|
||||
},
|
||||
Keys: kes.Keys{},
|
||||
}
|
||||
|
||||
// operator will mount the mTLSCertificates in the following paths
|
||||
// therefore we set these values in the KES yaml kesConfiguration
|
||||
var mTLSClientCrtPath = "/tmp/kes/client.crt"
|
||||
var mTLSClientKeyPath = "/tmp/kes/client.key"
|
||||
var mTLSClientCaPath = "/tmp/kes/ca.crt"
|
||||
// map to hold mTLSCertificates for KES mTLS against Vault
|
||||
mTLSCertificates := map[string][]byte{}
|
||||
|
||||
// if encryption is enabled and encryption is configured to use Vault
|
||||
if encryptionCfg.Vault != nil {
|
||||
// Initialize Vault Config
|
||||
|
||||
kesConfig.Keys.Vault = &kes.Vault{
|
||||
Endpoint: *encryptionCfg.Vault.Endpoint,
|
||||
EnginePath: encryptionCfg.Vault.Engine,
|
||||
Namespace: encryptionCfg.Vault.Namespace,
|
||||
Prefix: encryptionCfg.Vault.Prefix,
|
||||
Status: &kes.VaultStatus{
|
||||
Ping: 10 * time.Second,
|
||||
},
|
||||
}
|
||||
// Vault AppRole credentials
|
||||
if encryptionCfg.Vault.Approle != nil {
|
||||
kesConfig.Keys.Vault.AppRole = &kes.AppRole{
|
||||
EnginePath: encryptionCfg.Vault.Approle.Engine,
|
||||
ID: *encryptionCfg.Vault.Approle.ID,
|
||||
Secret: *encryptionCfg.Vault.Approle.Secret,
|
||||
Retry: 15 * time.Second,
|
||||
}
|
||||
} else {
|
||||
return nil, errors.New("approle credentials missing for kes")
|
||||
}
|
||||
|
||||
// Vault mTLS kesConfiguration
|
||||
if encryptionCfg.Vault.TLS != nil {
|
||||
vaultTLSConfig := encryptionCfg.Vault.TLS
|
||||
kesConfig.Keys.Vault.TLS = &kes.VaultTLS{}
|
||||
if vaultTLSConfig.Crt != "" {
|
||||
clientCrt, err := base64.StdEncoding.DecodeString(vaultTLSConfig.Crt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
mTLSCertificates["client.crt"] = clientCrt
|
||||
kesConfig.Keys.Vault.TLS.CertPath = mTLSClientCrtPath
|
||||
}
|
||||
if vaultTLSConfig.Key != "" {
|
||||
clientKey, err := base64.StdEncoding.DecodeString(vaultTLSConfig.Key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
mTLSCertificates["client.key"] = clientKey
|
||||
kesConfig.Keys.Vault.TLS.KeyPath = mTLSClientKeyPath
|
||||
}
|
||||
if vaultTLSConfig.Ca != "" {
|
||||
caCrt, err := base64.StdEncoding.DecodeString(vaultTLSConfig.Ca)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
mTLSCertificates["ca.crt"] = caCrt
|
||||
kesConfig.Keys.Vault.TLS.CAPath = mTLSClientCaPath
|
||||
}
|
||||
}
|
||||
} else if encryptionCfg.Aws != nil {
|
||||
// Initialize AWS
|
||||
kesConfig.Keys.Aws = &kes.Aws{
|
||||
SecretsManager: &kes.AwsSecretManager{},
|
||||
}
|
||||
// AWS basic kesConfiguration
|
||||
if encryptionCfg.Aws.Secretsmanager != nil {
|
||||
kesConfig.Keys.Aws.SecretsManager.Endpoint = *encryptionCfg.Aws.Secretsmanager.Endpoint
|
||||
kesConfig.Keys.Aws.SecretsManager.Region = *encryptionCfg.Aws.Secretsmanager.Region
|
||||
kesConfig.Keys.Aws.SecretsManager.KmsKey = encryptionCfg.Aws.Secretsmanager.Kmskey
|
||||
// AWS credentials
|
||||
if encryptionCfg.Aws.Secretsmanager.Credentials != nil {
|
||||
kesConfig.Keys.Aws.SecretsManager.Login = &kes.AwsSecretManagerLogin{
|
||||
AccessKey: *encryptionCfg.Aws.Secretsmanager.Credentials.Accesskey,
|
||||
SecretKey: *encryptionCfg.Aws.Secretsmanager.Credentials.Secretkey,
|
||||
SessionToken: encryptionCfg.Aws.Secretsmanager.Credentials.Token,
|
||||
}
|
||||
}
|
||||
}
|
||||
} else if encryptionCfg.Gemalto != nil {
|
||||
// Initialize Gemalto
|
||||
kesConfig.Keys.Gemalto = &kes.Gemalto{
|
||||
KeySecure: &kes.GemaltoKeySecure{},
|
||||
}
|
||||
// Gemalto Configuration
|
||||
if encryptionCfg.Gemalto.Keysecure != nil {
|
||||
kesConfig.Keys.Gemalto.KeySecure.Endpoint = *encryptionCfg.Gemalto.Keysecure.Endpoint
|
||||
// Gemalto TLS kesConfiguration
|
||||
if encryptionCfg.Gemalto.Keysecure.TLS != nil {
|
||||
if encryptionCfg.Gemalto.Keysecure.TLS.Ca != nil {
|
||||
caCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Gemalto.Keysecure.TLS.Ca)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
mTLSCertificates["ca.crt"] = caCrt
|
||||
kesConfig.Keys.Gemalto.KeySecure.TLS = &kes.GemaltoTLS{
|
||||
CAPath: mTLSClientCaPath,
|
||||
}
|
||||
}
|
||||
}
|
||||
// Gemalto Login
|
||||
if encryptionCfg.Gemalto.Keysecure.Credentials != nil {
|
||||
kesConfig.Keys.Gemalto.KeySecure.Credentials = &kes.GemaltoCredentials{
|
||||
Token: *encryptionCfg.Gemalto.Keysecure.Credentials.Token,
|
||||
Domain: *encryptionCfg.Gemalto.Keysecure.Credentials.Domain,
|
||||
Retry: 15 * time.Second,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// if mTLSCertificates contains elements we create the kubernetes secret
|
||||
if len(mTLSCertificates) > 0 {
|
||||
// Secret to store KES mTLS kesConfiguration
|
||||
kesClientCertSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: kesClientCertSecretName,
|
||||
},
|
||||
Immutable: &imm,
|
||||
Data: mTLSCertificates,
|
||||
}
|
||||
_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &kesClientCertSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// kubernetes generic secret
|
||||
kesConfiguration.ClientCertSecret = &operator.LocalCertificateReference{
|
||||
Name: kesClientCertSecretName,
|
||||
}
|
||||
}
|
||||
|
||||
// Generate Yaml kesConfiguration for KES
|
||||
serverConfigYaml, err := yaml.Marshal(kesConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Secret to store KES server kesConfiguration
|
||||
kesConfigurationSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: kesConfigurationSecretName,
|
||||
},
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"server-config.yaml": serverConfigYaml,
|
||||
},
|
||||
}
|
||||
_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &kesConfigurationSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Configuration used by KES
|
||||
kesConfiguration.Configuration = &corev1.LocalObjectReference{
|
||||
Name: kesConfigurationSecretName,
|
||||
}
|
||||
return kesConfiguration, nil
|
||||
}
|
||||
|
||||
@@ -91,6 +91,7 @@ func Test_TenantInfoTenantAdminClient(t *testing.T) {
|
||||
tenantName string
|
||||
serviceName string
|
||||
scheme string
|
||||
insecure bool
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -236,7 +237,7 @@ func Test_TenantInfoTenantAdminClient(t *testing.T) {
|
||||
k8sclientGetSecretMock = tt.mockGetSecret
|
||||
k8sclientGetServiceMock = tt.mockGetService
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := getTenantAdminClient(tt.args.ctx, tt.args.client, tt.args.namespace, tt.args.tenantName, tt.args.serviceName, tt.args.scheme)
|
||||
got, err := getTenantAdminClient(tt.args.ctx, tt.args.client, tt.args.namespace, tt.args.tenantName, tt.args.serviceName, tt.args.scheme, tt.args.insecure)
|
||||
if err != nil {
|
||||
if tt.wantErr {
|
||||
return
|
||||
|
||||
@@ -54,7 +54,8 @@ func NewAdminClientWithInsecure(url, accessKey, secretKey string, insecure bool)
|
||||
if err != nil {
|
||||
return nil, err.Trace(url)
|
||||
}
|
||||
s3Client.SetCustomTransport(STSClient.Transport)
|
||||
stsClient := PrepareSTSClient(insecure)
|
||||
s3Client.SetCustomTransport(stsClient.Transport)
|
||||
return s3Client, nil
|
||||
}
|
||||
|
||||
@@ -266,7 +267,8 @@ func newAdminFromClaims(claims *models.Principal) (*madmin.AdminClient, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
adminClient.SetCustomTransport(STSClient.Transport)
|
||||
stsClient := PrepareSTSClient(false)
|
||||
adminClient.SetCustomTransport(stsClient.Transport)
|
||||
return adminClient, nil
|
||||
}
|
||||
|
||||
|
||||
@@ -164,7 +164,6 @@ func (s consoleSTSAssumeRole) IsExpired() bool {
|
||||
|
||||
// STSClient contains http.client configuration need it by STSAssumeRole
|
||||
var (
|
||||
STSClient = PrepareSTSClient()
|
||||
MinioEndpoint = getMinIOServer()
|
||||
)
|
||||
|
||||
@@ -204,8 +203,9 @@ func newConsoleCredentials(accessKey, secretKey, location string) (*credentials.
|
||||
Location: location,
|
||||
DurationSeconds: xjwt.GetConsoleSTSAndJWTDurationInSeconds(),
|
||||
}
|
||||
stsClient := PrepareSTSClient(false)
|
||||
stsAssumeRole := &credentials.STSAssumeRole{
|
||||
Client: STSClient,
|
||||
Client: stsClient,
|
||||
STSEndpoint: MinioEndpoint,
|
||||
Options: opts,
|
||||
}
|
||||
@@ -234,10 +234,11 @@ func getConsoleCredentialsFromSession(claims *models.Principal) *credentials.Cre
|
||||
// from the provided jwt
|
||||
func newMinioClient(claims *models.Principal) (*minio.Client, error) {
|
||||
creds := getConsoleCredentialsFromSession(claims)
|
||||
stsClient := PrepareSTSClient(false)
|
||||
minioClient, err := minio.New(getMinIOEndpoint(), &minio.Options{
|
||||
Creds: creds,
|
||||
Secure: getMinIOEndpointIsSecure(),
|
||||
Transport: STSClient.Transport,
|
||||
Transport: stsClient.Transport,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
|
||||
@@ -2028,7 +2028,7 @@ func init() {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"enable_ssl": {
|
||||
"enable_tls": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
@@ -2108,18 +2108,7 @@ func init() {
|
||||
},
|
||||
"client": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
},
|
||||
"gemalto": {
|
||||
"type": "object",
|
||||
@@ -2128,23 +2117,9 @@ func init() {
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"master_key": {
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
},
|
||||
"vault": {
|
||||
"type": "object",
|
||||
@@ -2314,6 +2289,21 @@ func init() {
|
||||
}
|
||||
}
|
||||
},
|
||||
"keyPairConfiguration": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"listBucketEventsResponse": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
@@ -3037,16 +3027,14 @@ func init() {
|
||||
},
|
||||
"tlsConfiguration": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
"console": {
|
||||
"type": "object",
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
"minio": {
|
||||
"type": "object",
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
}
|
||||
}
|
||||
},
|
||||
@@ -3181,6 +3169,20 @@ func init() {
|
||||
"format": "int64"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"type": "string"
|
||||
},
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
@@ -3378,6 +3380,19 @@ func init() {
|
||||
}
|
||||
}
|
||||
},
|
||||
"zoneTolerationSeconds": {
|
||||
"description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
|
||||
"type": "object",
|
||||
"required": [
|
||||
"seconds"
|
||||
],
|
||||
"properties": {
|
||||
"seconds": {
|
||||
"type": "integer",
|
||||
"format": "int64"
|
||||
}
|
||||
}
|
||||
},
|
||||
"zoneTolerations": {
|
||||
"description": "Tolerations allows users to set entries like effect, key, operator, value.",
|
||||
"type": "array",
|
||||
@@ -3398,9 +3413,7 @@ func init() {
|
||||
"type": "string"
|
||||
},
|
||||
"tolerationSeconds": {
|
||||
"description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
|
||||
"type": "integer",
|
||||
"format": "int64"
|
||||
"$ref": "#/definitions/zoneTolerationSeconds"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.",
|
||||
@@ -5236,36 +5249,6 @@ func init() {
|
||||
}
|
||||
}
|
||||
},
|
||||
"EncryptionConfigurationClient": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"EncryptionConfigurationServer": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"GemaltoConfigurationKeysecure": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
@@ -5517,6 +5500,20 @@ func init() {
|
||||
}
|
||||
}
|
||||
},
|
||||
"VaultConfigurationTLS": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"type": "string"
|
||||
},
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ZoneAffinityNodeAffinity": {
|
||||
"description": "Describes node affinity scheduling rules for the pod.",
|
||||
"type": "object",
|
||||
@@ -5675,9 +5672,7 @@ func init() {
|
||||
"type": "string"
|
||||
},
|
||||
"tolerationSeconds": {
|
||||
"description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
|
||||
"type": "integer",
|
||||
"format": "int64"
|
||||
"$ref": "#/definitions/zoneTolerationSeconds"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.",
|
||||
@@ -5947,7 +5942,7 @@ func init() {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"enable_ssl": {
|
||||
"enable_tls": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
@@ -6027,18 +6022,7 @@ func init() {
|
||||
},
|
||||
"client": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
},
|
||||
"gemalto": {
|
||||
"type": "object",
|
||||
@@ -6047,23 +6031,9 @@ func init() {
|
||||
"image": {
|
||||
"type": "string"
|
||||
},
|
||||
"master_key": {
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
},
|
||||
"vault": {
|
||||
"type": "object",
|
||||
@@ -6233,6 +6203,21 @@ func init() {
|
||||
}
|
||||
}
|
||||
},
|
||||
"keyPairConfiguration": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"listBucketEventsResponse": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
@@ -6890,16 +6875,14 @@ func init() {
|
||||
},
|
||||
"tlsConfiguration": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"crt",
|
||||
"key"
|
||||
],
|
||||
"properties": {
|
||||
"crt": {
|
||||
"type": "string"
|
||||
"console": {
|
||||
"type": "object",
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
"minio": {
|
||||
"type": "object",
|
||||
"$ref": "#/definitions/keyPairConfiguration"
|
||||
}
|
||||
}
|
||||
},
|
||||
@@ -7034,6 +7017,20 @@ func init() {
|
||||
"format": "int64"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"type": "string"
|
||||
},
|
||||
"crt": {
|
||||
"type": "string"
|
||||
},
|
||||
"key": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
@@ -7184,6 +7181,19 @@ func init() {
|
||||
}
|
||||
}
|
||||
},
|
||||
"zoneTolerationSeconds": {
|
||||
"description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
|
||||
"type": "object",
|
||||
"required": [
|
||||
"seconds"
|
||||
],
|
||||
"properties": {
|
||||
"seconds": {
|
||||
"type": "integer",
|
||||
"format": "int64"
|
||||
}
|
||||
}
|
||||
},
|
||||
"zoneTolerations": {
|
||||
"description": "Tolerations allows users to set entries like effect, key, operator, value.",
|
||||
"type": "array",
|
||||
|
||||
@@ -30,12 +30,24 @@ var (
|
||||
certDontExists = "File certificate doesn't exists: %s"
|
||||
)
|
||||
|
||||
func prepareSTSClientTransport() *http.Transport {
|
||||
func prepareSTSClientTransport(insecure bool) *http.Transport {
|
||||
// This takes github.com/minio/minio/pkg/madmin/transport.go as an example
|
||||
//
|
||||
// DefaultTransport - this default transport is similar to
|
||||
// http.DefaultTransport but with additional param DisableCompression
|
||||
// is set to true to avoid decompressing content with 'gzip' encoding.
|
||||
|
||||
// Keep TLS config.
|
||||
tlsConfig := &tls.Config{
|
||||
// Can't use SSLv3 because of POODLE and BEAST
|
||||
// Can't use TLSv1.0 because of POODLE and BEAST using CBC cipher
|
||||
// Can't use TLSv1.1 because of RC4 cipher usage
|
||||
MinVersion: tls.VersionTLS12,
|
||||
}
|
||||
if insecure {
|
||||
tlsConfig.InsecureSkipVerify = true
|
||||
}
|
||||
|
||||
DefaultTransport := &http.Transport{
|
||||
Proxy: http.ProxyFromEnvironment,
|
||||
DialContext: (&net.Dialer{
|
||||
@@ -49,6 +61,7 @@ func prepareSTSClientTransport() *http.Transport {
|
||||
TLSHandshakeTimeout: 10 * time.Second,
|
||||
ExpectContinueTimeout: 1 * time.Second,
|
||||
DisableCompression: true,
|
||||
TLSClientConfig: tlsConfig,
|
||||
}
|
||||
// If Minio instance is running with TLS enabled and it's using a self-signed certificate
|
||||
// or a certificate issued by a custom certificate authority we prepare a new custom *http.Transport
|
||||
@@ -86,10 +99,11 @@ func prepareSTSClientTransport() *http.Transport {
|
||||
|
||||
// PrepareSTSClient returns an http.Client with custom configurations need it by *credentials.STSAssumeRole
|
||||
// custom configurations include the use of CA certificates
|
||||
func PrepareSTSClient() *http.Client {
|
||||
transport := prepareSTSClientTransport()
|
||||
func PrepareSTSClient(insecure bool) *http.Client {
|
||||
transport := prepareSTSClientTransport(insecure)
|
||||
// Return http client with default configuration
|
||||
return &http.Client{
|
||||
c := &http.Client{
|
||||
Transport: transport,
|
||||
}
|
||||
return c
|
||||
}
|
||||
|
||||
67
swagger.yml
67
swagger.yml
@@ -1822,7 +1822,7 @@ definitions:
|
||||
enable_console:
|
||||
type: boolean
|
||||
default: true
|
||||
enable_ssl:
|
||||
enable_tls:
|
||||
type: boolean
|
||||
default: true
|
||||
namespace:
|
||||
@@ -1845,7 +1845,7 @@ definitions:
|
||||
type: object
|
||||
$ref: "#/definitions/encryptionConfiguration"
|
||||
|
||||
tlsConfiguration:
|
||||
keyPairConfiguration:
|
||||
type: object
|
||||
required:
|
||||
- crt
|
||||
@@ -1856,6 +1856,16 @@ definitions:
|
||||
key:
|
||||
type: string
|
||||
|
||||
tlsConfiguration:
|
||||
type: object
|
||||
properties:
|
||||
minio:
|
||||
type: object
|
||||
$ref: "#/definitions/keyPairConfiguration"
|
||||
console:
|
||||
type: object
|
||||
$ref: "#/definitions/keyPairConfiguration"
|
||||
|
||||
idpConfiguration:
|
||||
type: object
|
||||
properties:
|
||||
@@ -1903,26 +1913,10 @@ definitions:
|
||||
type: string
|
||||
server:
|
||||
type: object
|
||||
required:
|
||||
- crt
|
||||
- key
|
||||
properties:
|
||||
crt:
|
||||
type: string
|
||||
key:
|
||||
type: string
|
||||
$ref: "#/definitions/keyPairConfiguration"
|
||||
client:
|
||||
type: object
|
||||
required:
|
||||
- crt
|
||||
- key
|
||||
properties:
|
||||
crt:
|
||||
type: string
|
||||
key:
|
||||
type: string
|
||||
master_key:
|
||||
type: string
|
||||
$ref: "#/definitions/keyPairConfiguration"
|
||||
gemalto:
|
||||
type: object
|
||||
$ref: "#/definitions/gemaltoConfiguration"
|
||||
@@ -1968,6 +1962,15 @@ definitions:
|
||||
ping:
|
||||
type: integer
|
||||
format: int64
|
||||
tls:
|
||||
type: object
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
crt:
|
||||
type: string
|
||||
ca:
|
||||
type: string
|
||||
|
||||
awsConfiguration:
|
||||
type: object
|
||||
@@ -2113,14 +2116,7 @@ definitions:
|
||||
category.
|
||||
type: string
|
||||
tolerationSeconds:
|
||||
description: TolerationSeconds represents the period of
|
||||
time the toleration (which must be of effect NoExecute,
|
||||
otherwise this field is ignored) tolerates the taint.
|
||||
By default, it is not set, which means tolerate the taint
|
||||
forever (do not evict). Zero and negative values will
|
||||
be treated as 0 (evict immediately) by the system.
|
||||
format: int64
|
||||
type: integer
|
||||
$ref: "#/definitions/zoneTolerationSeconds"
|
||||
value:
|
||||
description: Value is the taint value the toleration matches
|
||||
to. If the operator is Exists, the value should be empty,
|
||||
@@ -2128,6 +2124,21 @@ definitions:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
|
||||
zoneTolerationSeconds:
|
||||
description: TolerationSeconds represents the period of
|
||||
time the toleration (which must be of effect NoExecute,
|
||||
otherwise this field is ignored) tolerates the taint.
|
||||
By default, it is not set, which means tolerate the taint
|
||||
forever (do not evict). Zero and negative values will
|
||||
be treated as 0 (evict immediately) by the system.
|
||||
type: object
|
||||
required:
|
||||
- seconds
|
||||
properties:
|
||||
seconds:
|
||||
type: integer
|
||||
format: int64
|
||||
|
||||
zoneResources:
|
||||
description: If provided, use these requests and limit for cpu/memory
|
||||
|
||||
Reference in New Issue
Block a user