[Contributing FAQ] How do I use MinIO with https using a custom CA as an object store for Velero

[dsu-igeek]

How do I use MinIO with https using a custom CA as an object store for Velero

[dsu-igeek]

The instructions to do this are as follows.

• Setup CA cert
  • Generate private key for CA cert

    $ openssl genrsa -out rootCA.key 4096
    Generating RSA private key, 4096 bit long modulus
    ...................................................................................................................++
    ........................................................................................++
    e is 65537 (0x10001)

  • Generate public key (certificate) for the CA

    $ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1825 -out rootCA.pem
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) []:US
    State or Province Name (full name) []:WA
    Locality Name (eg, city) []:Bellevue
    Organization Name (eg, company) []:foo
    Organizational Unit Name (eg, section) []:bar
    Common Name (eg, fully qualified host name) []:foo bar
    Email Address []:[email protected]

• Generate certificate to use for MinIO
  • Generate private key

    $ openssl genrsa -out private.key 2048
    Generating RSA private key, 2048 bit long modulus
    ..................................................................................+++
    .........................+++
    e is 65537 (0x10001)

  • Generate public key (certificate) for MinIO
    • Generate a certificate signing request (CSR)

      $ openssl req -subj "/CN=192.168.0.105" -sha256 -new -key private.key -out cert.csr
      

    • Using the CA private key sign the above created CSR to issue the cert

      $ cat ./extfile.conf
      subjectAltName = IP:192.168.0.105
      $ openssl x509 -req -days 365 -sha256 -in cert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out public.crt -extfile extfile.conf
      Signature ok
      subject=/CN=192.168.0.105
      Getting CA Private Key

      NOTE:
      1. The IP used here is the local IP of the server hosting the MinIO service.
      2. These instructions lets you explore the Velero's custom ca cert functionality. Configuring Minio for production is out of scope for these instructions.
  • Copy the generated certificates to a path that can be mounted into the docker container that will run MinIO.

    $ cp ./public.crt ./private.key <PATH_TO_BE_MOUNTED_INTO_MINIO>
    $ mkdir <PATH_TO_BE_MOUNTED_INTO_MINIO>/CAs
    $ cp ./rootCA.pem <PATH_TO_BE_MOUNTED_INTO_MINIO>/CAs

  • Run MinIO docker image

    $ docker run -p 443:443 -v <PATH_TO_BE_MOUNTED_INTO_MINIO>:/root/.minio -v <DATA_DIR_FOR_MINIO>/:/data -e "MINIO_ACCESS_KEY=minio"     -e "MINIO_SECRET_KEY=minio123"  minio/minio server --certs-dir=/root/.minio --address ":443" /data
    Endpoint:  https://172.17.0.2  https://127.0.0.1
    
    Browser Access:
    https://172.17.0.2  https://127.0.0.1
    
    Object API (Amazon S3 compatible):
    Go:         https://docs.min.io/docs/golang-client-quickstart-guide
    Java:       https://docs.min.io/docs/java-client-quickstart-guide
    Python:     https://docs.min.io/docs/python-client-quickstart-guide
    JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
    .NET:       https://docs.min.io/docs/dotnet-client-quickstart-guide

  • Install Velero passing it the PEM encoded ca cert bundle

    $ velero install \
        --provider aws \
        --plugins velero/velero-plugin-for-aws:v1.1.0 \
        --bucket $BUCKET \
        --prefix $PREFIX \
        --backup-location-config region=minio,s3ForcePathStyle="true",s3Url=https://192.168.0.105 \
        --snapshot-location-config region=$REGION \
        --secret-file ./credentials-velero \
        --image velero/velero:main \
        --cacert <PATH_TO_CA_CERT_PEM>/rootCA.pem

  NOTE:
  1. Though you are running MinIO on your laptop and can connect to it from your browser from 127.0.0.1 or localhost this cannot be used as the IP for generating certificates as Velero will be presented with a certificate for 127.0.0.1 but will be connecting to MinIO on a different IP.
  2. The value used for the --cacert flag should be the PEM encoded CA certificate generated in the first step.
  3. The same PEM encoded CA cert bundle should be used in the --cacert flag for velero backup describe, velero backup logs, and velero restore logs commands.
  4. If you don't have the PEM encoded CA cert bundle, one can be generated using

     $ openssl x509 -inform DER -outform PEM -in server.crt -out server.crt.pem

  5. If you are not using a custom CA, but are using self-signed certificates, then Velero will not be able to validate the certificate presented by MinIO. You can continue using https to connect to MinIO, but you will have to disable certificate validation by setting the insecureSkipTLSVerify="true" config in your backup storage location under spec.config map