[bitnami/minio] redirecting to 9001 port with API ingress

[slax81]

Which chart: latest minio chart

Describe the bug when you enter the root API URL, minio API redirect that URL to port 9001

To Reproduce Steps to reproduce the behavior:

I have for example storage.example.com for API ingress. When you type storage.example.com/bucketname the page displays access denied as it is supposed to, but when you enter root URL storage.example.com, service redirects it to storage.example.com:9001.

Expected behavior redirect to 404 page

Version of Helm and Kubernetes:

• Output of helm version:

(paste your output here)

• Output of kubectl version:

(paste your output here)

Additional context I wish to change the default behavior if possible. @migruiz4

[randradas]

Hello @slax81 could you please provide the exact commands and parameters you used step by step? ty!

[slax81]

Hello @randradas, I've deployed the helm chart with custom values to a cluster. I setup ingress value for api and also for console service. Now i have objectstorage.getbamboo.com ingress for API and minio-console.getbamboo.com for Console UI. When I type URL in browser objectstorage.getbamboo.com, browser is redirected to objectstorage.getbamboo.com:9001

I'm guessing when you type the root url for api ingress it tries to redirect you to console ui (since it is on port 9001), but the ingress for console is different. it is not objectstorage.getbamboo.com....

I would like to stop somehow this behavior or redirect to some other url, or display 404 error instead of redirecting to 9001 port. Thank you for the reply

[randradas]

Hello @slax81 thank you for the explanation but I need something more "machine"-compatible. I mean, a value.yaml file with your values, a copy&paste of the command you run to install the helm chart rather than a paragraph for humans. Ty!

[slax81]

Yes, sorry @randradas i installed the helm chart with:

helm repo add bitnami https://charts.bitnami.com/bitnami helm install minio -f values.yaml --create-namespace --namespace minio bitnami/minio

and the values are attached values.yaml.txt

[electrical]

I'm running into the same issue. Ingress created via the helm chart with https but wants to redirect to port 9001. I suspect this is happening from within minio.

[electrical]

Seems to be it only happens when viewing with a browser, it tries to redirect you to the console. When using the correct tools like s3cmd it all works fine. That said, the redirect doesn't work as expected when an ingress has been set for the console.

[slax81]

I figured as much, but how do we make minio redirect to console ingress? Should this issue be posted to minio directly?

[electrical]

I believe this is a minio issue yeah and not related to the helm chart. My best guess is that a separate config needs to be added for the console ingress url so it redirects to that.

[randradas]

Thank you @slax81 we will try to reproduce with the values you provided.

[github-actions[bot]]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions[bot]]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

[MatthiasHertel]

hi

i have exactly the same issue:

how can i fix it , maybe with the applied config-map or environment ?

my installed values.yaml:

## Provide a name in place of minio for `app:` labels
##
nameOverride: ""

## Provide a name to substitute for the full names of resources
##
fullnameOverride: ""

## set kubernetes cluster domain where minio is running
##
clusterDomain: cluster.local

## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
##
image:
  repository: quay.io/minio/minio
  tag: RELEASE.2021-12-29T06-49-06Z
  pullPolicy: IfNotPresent

imagePullSecrets: []
# - name: "image-pull-secret"

## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio
## client used to create a default bucket).
##
mcImage:
  repository: quay.io/minio/mc
  tag: RELEASE.2021-12-29T06-52-55Z
  pullPolicy: IfNotPresent

## minio mode, i.e. standalone or distributed or gateway.
mode: standalone ## other supported values are "standalone", "gateway"

## Additional labels to include with deployment or statefulset
additionalLabels: []

## Additional annotations to include with deployment or statefulset
additionalAnnotations: []

## Additional arguments to pass to minio binary
extraArgs: []

## Port number for MinIO S3 API Access
minioAPIPort: "9000"

## Port number for MinIO Browser COnsole Access
minioConsolePort: "9001"

## Update strategy for Deployments
DeploymentUpdate:
  type: Recreate
  maxUnavailable: 0
  maxSurge: 100%

## Update strategy for StatefulSets
StatefulSetUpdate:
  updateStrategy: Recreate

## Pod priority settings
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
##
priorityClassName: ""

## Set default rootUser, rootPassword
## AccessKey and secretKey is generated when not set
## Distributed MinIO ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
##
rootUser: "minio_access_key"
rootPassword: "minio_secret_key"

## Use existing Secret that store following variables:
##
## | Chart var             | .data.<key> in Secret    |
## |:----------------------|:-------------------------|
## | rootUser              | rootUser                 |
## | rootPassword          | rootPassword             |
##
## All mentioned variables will be ignored in values file.
## .data.rootUser and .data.rootPassword are mandatory,
## others depend on enabled status of corresponding sections.
existingSecret: ""

## Directory on the MinIO pof
certsPath: "/etc/minio/certs/"
configPathmc: "/etc/minio/mc/"

## Path where PV would be mounted on the MinIO Pod
mountPath: "/export"
## Override the root directory which the minio server should serve from.
## If left empty, it defaults to the value of {{ .Values.mountPath }}
## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }}
##
bucketRoot: ""

# Number of drives attached to a node
drivesPerNode: 1
# Number of MinIO containers running
replicas: 1
# Number of expanded MinIO clusters
pools: 1

# Deploy if 'mode == gateway' - 4 replicas.
gateway:
  type: "nas" # currently only "nas,gcs" are supported.
  replicas: 4
  gcs:
    serviceAccountFile: "" # credential JSON file of service account key (not required if using existing secret)
    projectId: "" # Google cloud project id required

## TLS Settings for MinIO
tls:
  enabled: false
  ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
  certSecret: ""
  publicCrt: public.crt
  privateKey: private.key

## Trusted Certificates Settings for MinIO. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas
## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt.
## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
trustedCertsSecret: ""

## Enable persistence using Persistent Volume Claims
## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
  enabled: true
  annotations: {}

  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  existingClaim: ""

  ## minio data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  ## Storage class of PV to bind. By default it looks for standard storage class.
  ## If the PV uses a different storage class, specify that here.
  storageClass: "csi-rbd-sc-ssd"
  VolumeName: ""
  accessMode: ReadWriteOnce
  size: 5Gi

  ## If subPath is set mount a sub folder of a volume instead of the root of the volume.
  ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs).
  ##
  subPath: ""

## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service).
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
  type: ClusterIP
  clusterIP: ~
  ## Make sure to match it to minioAPIPort
  port: "9000"
  nodePort: 32000

## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/
##

ingress:
  enabled: true
  # ingressClassName: ""
  labels: {}
    # node-role.kubernetes.io/ingress: platform

  annotations:
    kubernetes.io/ingress.class: "lb-01"
    traefik.ingress.kubernetes.io/router.middlewares: "lb-01-https-redirect@kubernetescrd,lb-01-sec-headers@kubernetescrd"
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
  path: /
  hosts:
    - minio-s3-01.example.com
  tls:
   - secretName: lb-01-minio-03-minio-s3-01-secret
     hosts:
       - minio-s3-01.example.com

consoleService:
  type: ClusterIP
  clusterIP: ~
  ## Make sure to match it to minioConsolePort
  port: "9001"
  nodePort: 32001

consoleIngress:
  enabled: true
  # ingressClassName: ""
  labels: {}
    # node-role.kubernetes.io/ingress: platform

  annotations:
    kubernetes.io/ingress.class: "lb-01"
    traefik.ingress.kubernetes.io/router.middlewares: "lb-01-https-redirect@kubernetescrd,lb-01-sec-headers@kubernetescrd"
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
  path: /
  hosts:
    - minio-console-01.example.com
  tls:
   - secretName: lb-01-minio-03-minio-console-01-secret
     hosts:
       - minio-console-01.example.com

## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
tolerations: []
affinity: {}

## Add stateful containers to have security context, if enabled MinIO will run as this
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
securityContext:
  enabled: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000

# Additational pod annotations
podAnnotations: {}

# Additional pod labels
podLabels: {}

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    memory: 2Gi

## List of users to be created after minio install
##
users:
  ## Username, password and policy to be assigned to the user
  ## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics]
  ## Add new policies as explained here https://docs.min.io/docs/minio-multi-user-quickstart-guide.html
  ## NOTE: this will fail if LDAP is enabled in your MinIO deployment
  ## make sure to disable this if you are using LDAP.
  - accessKey: console
    secretKey: console123
    policy: consoleAdmin

## Additional Annotations for the Kubernetes Job makeUserJob
makeUserJob:
  podAnnotations:
  annotations:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  nodeSelector: {}
  tolerations: []
  affinity: {}

## List of buckets to be created after minio install
##
buckets:
  #   # Name of the bucket
  # - name: bucket1
  #   # Policy to be set on the
  #   # bucket [none|download|upload|public]
  #   policy: none
  #   # Purge if bucket exists already
  #   purge: false
  #   # set versioning for
  #   # bucket [true|false]
  #   versioning: false
  # - name: bucket2
  #   policy: none
  #   purge: false
  #   versioning: true

## Additional Annotations for the Kubernetes Job makeBucketJob
makeBucketJob:
  podAnnotations:
  annotations:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  nodeSelector: {}
  tolerations: []
  affinity: {}

## Use this field to add environment variables relevant to MinIO server. These fields will be passed on to MinIO container(s)
## when Chart is deployed
environment:
  ## Please refer for comprehensive list https://docs.min.io/minio/baremetal/reference/minio-server/minio-server.html
  ## MINIO_SUBNET_LICENSE: "License key obtained from https://subnet.min.io"
  ## MINIO_BROWSER: "off"

networkPolicy:
  enabled: false
  allowExternal: true

## PodDisruptionBudget settings
## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
##
podDisruptionBudget:
  enabled: false
  maxUnavailable: 1

## Specify the service account to use for the MinIO pods. If 'create' is set to 'false'
## and 'name' is left unspecified, the account 'default' will be used.
serviceAccount:
  create: true
  ## The name of the service account to use. If 'create' is 'true', a service account with that name
  ## will be created.
  name: "minio-sa"

metrics:
  serviceMonitor:
    enabled: false
    public: true
    additionalLabels: {}
    relabelConfigs: {}
    # namespace: monitoring
    # interval: 30s
    # scrapeTimeout: 10s

## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md
## Define endpoints to enable this section.
etcd:
  endpoints: []
  pathPrefix: ""
  corednsPathPrefix: ""
  clientCert: ""
  clientCertKey: ""

[juan131]

@MatthiasHertel could you please open a new issue filling the Issue template with the required info? Thanks in advance

[dyipon]

small workaround in minio apiIngress:

  rules:
  - host: cdn.minio.hostname
    http:
      paths:
      - backend:
          service:
            name: minio
            port:
              name: minio-api
        path: /.*/.*
        pathType: ImplementationSpecific

With this method nginx-ingress does not forward the / request to minio.

[masterkain]

    extraEnvVars:
      - name: MINIO_BROWSER_REDIRECT_URL
        value: "https://my.minio.console"