Support minio tenants using 'secure' + 'requestAutoCert' set to True

[redtex]

Hello ! Actually, it's almost impossible to make it work without defining endpoint_overrides dictionary. I mean, that when minio run in https mode, it uses self-signed certificate, which is not trusted for minio_operator_ext. So, we have to run it through ingress, which contains trusted cert. So, my problem is - how to define endpoint_overrides dictionary ? I can't find it in the code.

[benfiola]

To handle this scenario, I was thinking that the operator could:

• Find the certificate bundle if it was autogenerated and is operating in secure mode
• Additionally accept a reference to a cert bundle it could use for verification (- in the case that another tool generated the self-signed certs, like cert-manager/trust-manager) - perhaps by annotating the minio tenant resource directly?

How does that sound?

[redtex]

Sounds good. But there is one more thing - in the code, there is hard-coded k8s cluster name - {service_name}.{namespace}.svc.cluster.local In my opinion, it's better not to use 'svc.cluster.local' at all. Just {service_name}.{namespace} will be enough. Or there is must be endpoint with correct cluster name.

[benfiola]

Created a PR that handles secure minio tenants that use the 'requestAutoCert' setting. There are a few ways to create certs for minio tenants - of which this is one of them - so this fix is by no means robust. But, from my local testing, it appears to work.

NOTE: The changes require updated RBAC as we need to grab the CA from the namespace's kube-root-ca.crt configmap.

[benfiola]

Sounds good. But there is one more thing - in the code, there is hard-coded k8s cluster name - {service_name}.{namespace}.svc.cluster.local In my opinion, it's better not to use 'svc.cluster.local' at all. Just {service_name}.{namespace} will be enough. Or there is must be endpoint with correct cluster name.

I've addressed this in another PR that has been merged!

[redtex]

Sorry for late answer - I'm on vacation. Works fine !!