minio / mc

Unix like utilities for object store
https://min.io/download
GNU Affero General Public License v3.0
2.88k stars 550 forks source link

add global `--resolve HOST[:PORT]=IP` flag #5013

Closed aead closed 3 months ago

aead commented 3 months ago

Description

This commit adds support for custom DNS overwrites via one or multiple --resolve flags. It allows mc users to define custom DNS mappings from a HOST (and optional port) to an IP address.

For example:

mc --resolve foo.com:9000:10.1.2.3 ls myminio/mybucket

The --resolve syntax is taken from cURL. Ref. curl --help dns

Use cases:

  1. DNS overwrites. If there are no DNS resolvers available, e.g. due to a temp. outage, this allows mc to connect to a defined alias as long as the IP of the one or multiple cluster nodes are known. It also allows mc to overwrite the current DNS responses. This is useful for various tests in dev and staging environments.
  2. TLS certificate verification. Often TLS certificates are issued for some DNS names (via SAN) but not for IP addresses. IP addresses are usually not static and might change anytime. Accessing a MinIO cluster that serves a certificate containing only DNS SANs via an IP address results in a TLS certificate verification error - even if the certificate is issued by a trusted CA. The current workaround is the --insecure flag which disables TLS certification completely.

Example for TLS verification:

$ mc alias set 'myminio' 'https://192.168.188.118:9000' 'minioadmin' 'minioadmin'
mc: <ERROR> Unable to initialize new alias from the provided credentials.
Get "https://192.168.188.118:9000": tls: failed to verify certificate:
x509: cannot validate certificate for 192.168.188.118 because it doesn't contain any IP SANs.
mc alias set --resolve foo.com:9000:192.168.188.118 'myminio' 'https://foo.com:9000' 'minioadmin' 'minioadmin'
Added `myminio` successfully.

Motivation and Context

TLS

How to test this PR?

Types of changes

Checklist:

allanrogerr commented 3 months ago

Tested

minio server /tmp/data &
mc alias set --resolve minio.train:9000=127.0.0.1 resolved http://minio.train:9000 minioadmin minioadmin
mc admin info resolved --resolve minio.train:9000=127.0.0.1