Skip to content

Commit 009a153

Browse files
ravindk89ravindk89
committed
Continued fixups
1 parent 973ff52 commit 009a153

25 files changed

+81
-2844
lines changed

‎source/administration/console/security-and-access.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
2-
31
.. _minio-console-security-access:
2+
43
:orphan:
4+
55
===================
66
Security and Access
77
===================

‎source/administration/identity-access-management/policy-based-access-control.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -970,7 +970,7 @@ To select all of the available kms policy actions, use ``kms:*``.
970970

971971
For example, the following policy document allows a user to list keys, create new keys, and check the status of keys for any resource that begins with ``keys-abc-`` or ``myuser-``.
972972

973-
.. codeblock:: shell
973+
.. code-block:: shell
974974
:class: copyable
975975
976976
{

‎source/developers/file-transfer-protocol.rst

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ File Transfer Protocol (FTP/SFTP)
1515
:depth: 2
1616

1717
.. tab-set::
18-
:class: parent
1918

2019
.. tab-item:: Kubernetes
2120
:sync: k8s
@@ -41,7 +40,6 @@ Supported Protocols
4140
-------------------
4241

4342
.. tab-set::
44-
:class: hidden
4543

4644
.. tab-item:: Kubernetes
4745
:sync: k8s
@@ -121,7 +119,6 @@ Prerequisites
121119
-------------
122120

123121
.. tab-set::
124-
:class: hidden
125122

126123
.. tab-item:: Kubernetes
127124
:sync: k8s
@@ -141,7 +138,6 @@ Procedure
141138
---------
142139

143140
.. tab-set::
144-
:class: hidden
145141

146142
.. tab-item:: Kubernetes
147143
:sync: k8s
@@ -171,7 +167,7 @@ This type of authentication requires the following:
171167

172168
The keys must include a `principals list <https://man.openbsd.org/ssh-keygen#CERTIFICATES>`__ of the user(s) that can authenticate with the key:
173169

174-
.. code-block:: console
170+
.. code-block:: shell
175171
:class: copyable
176172
177173
ssh-keygen -s ~/.ssh/ca_user_key -I miniouser -n miniouser -V +1h -z 1 miniouser1.pub
@@ -189,10 +185,10 @@ The keys must include a `principals list <https://man.openbsd.org/ssh-keygen#CER
189185
MinIO requires specifying the Certificate Authority used to sign the certificates for SFTP access.
190186
Start or restart the MinIO Server and specify the path to the trusted certificate authority's public key using an ``--sftp="trusted-user-ca-key=PATH"`` flag:
191187

192-
.. code-block:: console
193-
:class: copyable
188+
.. code-block:: shell
189+
:class: copyable
194190
195-
minio server {path-to-server} --sftp="trusted-user-ca-key=/path/to/.ssh/ca_user_key.pub" {...other flags}
191+
minio server {path-to-server} --sftp="trusted-user-ca-key=/path/to/.ssh/ca_user_key.pub" {...other flags}
196192
197193
When connecting to the MinIO Server with SFTP, the client verifies the MinIO Server's certificate.
198194
The client then passes its own certificate to the MinIO Server.

‎source/includes/baremetal/steps-configure-ad-ldap-external-identity-management.rst

Lines changed: 16 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44

55
* MinIO Client
66
* Environment variables
7-
* MinIO Console
87

98
All methods require starting/restarting the MinIO deployment to apply changes.
109

@@ -19,32 +18,33 @@
1918
For distributed deployments, the :mc:`mc idp ldap` command applies the configuration to all nodes in the deployment.
2019

2120
The following example code sets *all* configuration settings related to configuring an AD/LDAP provider for external identity management.
22-
The minimum *required* settings are:
21+
The minimum *required* settings are:
2322

2423
- :mc-conf:`server_addr <identity_ldap.server_addr>`
2524
- :mc-conf:`lookup_bind_dn <identity_ldap.lookup_bind_dn>`
2625
- :mc-conf:`lookup_bind_password <identity_ldap.lookup_bind_password>`
2726
- :mc-conf:`user_dn_search_base_dn <identity_ldap.user_dn_search_base_dn>`
2827
- :mc-conf:`user_dn_search_filter <identity_ldap.user_dn_search_filter>`
2928

30-
.. code-block:: shell
31-
:class: copyable
29+
.. code-block:: shell
30+
:class: copyable
3231
33-
mc idp ldap add ALIAS \
34-
server_addr="ldaps.example.net:636" \
32+
mc idp ldap add ALIAS \
33+
server_addr="ldaps.example.net:636" \
3534
lookup_bind_dn="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net" \
36-
lookup_bind_password="xxxxxxxx" \
37-
user_dn_search_base_dn="DC=example,DC=net" \
38-
user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))" \
39-
group_search_filter= "(&(objectClass=group)(member=%d))" \
40-
group_search_base_dn="ou=MinIO Users,dc=example,dc=net" \
41-
enabled="true" \
35+
lookup_bind_password="xxxxxxxx" \
36+
user_dn_search_base_dn="DC=example,DC=net" \
37+
user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))" \
38+
group_search_filter= "(&(objectClass=group)(member=%d))" \
39+
group_search_base_dn="ou=MinIO Users,dc=example,dc=net" \
4240
tls_skip_verify="off" \
4341
server_insecure=off \
4442
server_starttls="off" \
4543
srv_record_name="" \
4644
comment="Test LDAP server"
4745
46+
For Kubernetes deployments, ensure the `ALIAS` corresponds to the externally accessible hostname for the MinIO Tenant.
47+
4848
For more complete documentation on these settings, see :mc:`mc idp ldap`.
4949

5050
.. admonition:: :mc:`mc idp ldap` recommended
@@ -58,9 +58,9 @@
5858
.. tab-item:: Environment Variables
5959

6060
MinIO supports specifying the AD/LDAP provider settings using :ref:`environment variables <minio-server-envvar-external-identity-management-ad-ldap>`.
61-
The :mc:`minio server` process applies the specified settings on its next startup.
62-
For distributed deployments, specify these settings across all nodes in the deployment using the *same* values.
63-
Any differences in server configurations between nodes will result in startup or configuration failures.
61+
The :mc:`minio server` process applies the specified settings on its next startup.
62+
For distributed deployments, specify these settings across all nodes in the deployment using the *same* values.
63+
Any differences in server configurations between nodes will result in startup or configuration failures.
6464

6565
The following example code sets *all* environment variables related to configuring an AD/LDAP provider for external identity management. The minimum *required* variable are:
6666

@@ -86,16 +86,7 @@
8686
export MINIO_IDENTITY_LDAP_SRV_RECORD_NAME=""
8787
export MINIO_IDENTITY_LDAP_COMMENT="LDAP test server"
8888
89-
For complete documentation on these variables, see :ref:`minio-server-envvar-external-identity-management-ad-ldap`
90-
91-
.. tab-item:: MinIO Console
92-
93-
MinIO supports specifying the AD/LDAP provider settings using the :ref:`MinIO Console <minio-console>`.
94-
For distributed deployments, configuring AD/LDAP from the Console applies the configuration to all nodes in the deployment.
95-
96-
.. include:: /includes/common-minio-external-auth.rst
97-
:start-after: start-minio-ad-ldap-console-enable
98-
:end-before: end-minio-ad-ldap-console-enable
89+
For complete documentation on these variables, see :ref:`minio-server-envvar-external-identity-management-ad-ldap`.
9990

10091
#. Restart the MinIO Deployment
10192

‎source/includes/baremetal/steps-configure-keycloak-identity-management.rst

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,18 +33,11 @@
3333

3434
MinIO supports multiple methods for configuring Keycloak authentication:
3535

36-
- Using the MinIO Console
3736
- Using a terminal/shell and the :mc:`mc idp openid` command
3837
- Using environment variables set prior to starting MinIO
3938

4039
.. tab-set::
4140

42-
.. tab-item:: MinIO Console
43-
44-
.. include:: /includes/common/common-configure-keycloak-identity-management.rst
45-
:start-after: start-configure-keycloak-minio-console
46-
:end-before: end-configure-keycloak-minio-console
47-
4841
.. tab-item:: CLI
4942

5043
.. include:: /includes/common/common-configure-keycloak-identity-management.rst

‎source/includes/common/common-configure-keycloak-identity-management.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ The following example code sets the minimum required environment variables relat
322322
:class: copyable
323323
:substitutions:
324324
325-
MINIO_IDENTITY_OPENID_CONFIG_URL_PRIMARY_IAM="https://|KEYCLOAK_URL|/.well-known/openid-configuration"
325+
MINIO_IDENTITY_OPENID_CONFIG_URL_PRIMARY_IAM="https://|KEYCLOAK_URL|/realms/REALM/.well-known/openid-configuration"
326326
MINIO_IDENTITY_OPENID_CLIENT_ID_PRIMARY_IAM="MINIO_CLIENT"
327327
MINIO_IDENTITY_OPENID_CLIENT_SECRET_PRIMARY_IAM="MINIO_CLIENT_SECRET"
328328
MINIO_IDENTITY_OPENID_DISPLAY_NAME_PRIMARY_IAM="SSO_IDENTIFIER"

‎source/includes/linux/file-transfer-protocol-not-k8s.rst

Lines changed: 0 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -79,97 +79,6 @@
7979

8080
.. code-block:: shell
8181
82-
<<<<<<< HEAD
83-
.. code-block:: console
84-
:class: copyable
85-
86-
ssh-keygen -s ~/.ssh/ca_user_key -I miniouser -n miniouser -V +1h -z 1 miniouser1.pub
87-
88-
- ``-s`` specifies the path to the certificate authority public key to use for generating this key.
89-
The specified public key must have a ``principals`` list that includes this user.
90-
- ``-I`` specifies the key identity for the public key.
91-
- ``-n`` creates the ``user principals`` list for which this key is valid.
92-
You must include the user for which this key is valid, and the user must match the username in MinIO.
93-
- ``-V`` limits the duration for which the generated key is valid.
94-
In this example, the key is valid for one hour.
95-
Adjust the duration for your requirements.
96-
- ``-z`` adds a serial number to the key to distinguish this generated public key from other keys signed by the same certificate authority public key.
97-
98-
MinIO requires specifying the Certificate Authority used to sign the certificates for SFTP access.
99-
Start or restart the MinIO Server and specify the path to the trusted certificate authority's public key using an ``--sftp="trusted-user-ca-key=PATH"`` flag:
100-
101-
.. code-block:: console
102-
:class: copyable
103-
104-
minio server {path-to-server} --sftp="trusted-user-ca-key=/path/to/.ssh/ca_user_key.pub" {...other flags}
105-
106-
When connecting to the MinIO Server with SFTP, the client verifies the MinIO Server's certificate.
107-
The client then passes its own certificate to the MinIO Server.
108-
The MinIO Server verifies the key created above by comparing its value to the the known public key from the certificate authority provided at server startup.
109-
110-
Once the MinIO Server verifies the client's certificate, the user can connect to the MinIO server over SFTP:
111-
112-
.. code-block:: bash
113-
:class: copyable:
114-
115-
sftp -P <SFTP port> <server IP>
116-
117-
118-
Procedure
119-
+++++++++
120-
121-
The following procedure generates two key-value pairs, signs one with the other, then uses the resulting signed key to log in to the SFTP server.
122-
123-
1. Generate a key-value pair for the MinIO Server
124-
125-
.. code-block:: bash
126-
:class: copyable
127-
128-
ssh-keygen -f ./ca_user_key
129-
130-
2. Generate a key-value pair for the user
131-
132-
.. code-block:: bash
133-
:class: copyable
134-
135-
ssh-keygen -f ./minioadmin
136-
137-
Replace ``minioadmin`` with the user accessing the MinIO Server by SFTP.
138-
139-
3. Sign the user key-value pair key with the MinIO Server key-value pair key
140-
141-
.. code-block:: bash
142-
:class: copyable
143-
144-
ssh-keygen -s ca_user_key -I minioadmin -n minioadmin -V +30d -z 1 minioadmin.pub
145-
146-
Move the ``minioadmin.pub`` key to the same directory as ``minioadmin`` key-value pair, such as ``~/.ssh/meaningful-directory``.
147-
148-
4. Start or restart the MinIO Server passing the generated public keys
149-
150-
.. code-block:: bash
151-
:class: copyable
152-
153-
minio server --sftp="address=:8022" --sftp="ssh-private-key=/path/to/ca_user_key" --sftp="trusted-user-ca-key=/path/to/ca_user_key.pub"
154-
155-
5. Connect to the MinIO Server by sftp
156-
157-
.. code-block:: bash
158-
:class: copyable
159-
160-
sftp -i ./minioadmin -oPort=8022 minioadmin@localhost
161-
162-
163-
Require service account or LDAP for authentication
164-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
165-
166-
To force authentication to SFTP using LDAP or service account credentials, append a suffix to the username.
167-
Valid suffixes are either ``=ldap`` or ``=svc``.
168-
169-
.. code-block:: console
170-
171-
> sftp -P 8022 my-ldap-user=ldap@[minio@localhost]:/bucket
172-
=======
17382
> ftp localhost -P 8021
17483
Connected to localhost.
17584
220 Welcome to MinIO FTP Server
@@ -185,7 +94,6 @@ Valid suffixes are either ``=ldap`` or ``=svc``.
18594
drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 chunkdocs/
18695
drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 testdir/
18796
...
188-
>>>>>>> 8da23e1 (Attempting to reduce docs to single platform)
18997
19098
19199
4. Download an Object

‎source/index.rst

Lines changed: 6 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ MinIO High Performance Object Storage
44

55
.. default-domain:: minio
66

7-
.. cond:: container
7+
.. cond:: mindocs
88

99
.. container:: extlinks-video
1010

@@ -14,40 +14,6 @@ MinIO High Performance Object Storage
1414

1515
- `How to Connect to MinIO with JavaScript <https://www.youtube.com/watch?v=yUR4Fvx0D3E&list=PLFOIsHSSYIK3Dd3Y_x7itJT1NUKT5SxDh&index=5>`__
1616

17-
.. cond:: k8s
18-
19-
.. container:: extlinks-video
20-
21-
- `Object Storage Essentials <https://www.youtube.com/playlist?list=PLFOIsHSSYIK3WitnqhqfpeZ6fRFKHxIr7>`__
22-
23-
- `How to Connect to MinIO with JavaScript <https://www.youtube.com/watch?v=yUR4Fvx0D3E&list=PLFOIsHSSYIK3Dd3Y_x7itJT1NUKT5SxDh&index=5>`__
24-
25-
.. cond:: linux
26-
27-
.. container:: extlinks-video
28-
29-
- `Installing and Running MinIO on Linux <https://www.youtube.com/watch?v=74usXkZpNt8&list=PLFOIsHSSYIK1BnzVY66pCL-iJ30Ht9t1o>`__
30-
31-
- `Object Storage Essentials <https://www.youtube.com/playlist?list=PLFOIsHSSYIK3WitnqhqfpeZ6fRFKHxIr7>`__
32-
33-
- `How to Connect to MinIO with JavaScript <https://www.youtube.com/watch?v=yUR4Fvx0D3E&list=PLFOIsHSSYIK3Dd3Y_x7itJT1NUKT5SxDh&index=5>`__
34-
35-
.. cond:: macos
36-
37-
.. container:: extlinks-video
38-
39-
- `Object Storage Essentials <https://www.youtube.com/playlist?list=PLFOIsHSSYIK3WitnqhqfpeZ6fRFKHxIr7>`__
40-
41-
- `How to Connect to MinIO with JavaScript <https://www.youtube.com/watch?v=yUR4Fvx0D3E&list=PLFOIsHSSYIK3Dd3Y_x7itJT1NUKT5SxDh&index=5>`__
42-
43-
.. cond:: windows
44-
45-
.. container:: extlinks-video
46-
47-
- `Object Storage Essentials <https://www.youtube.com/playlist?list=PLFOIsHSSYIK3WitnqhqfpeZ6fRFKHxIr7>`__
48-
49-
- `How to Connect to MinIO with JavaScript <https://www.youtube.com/watch?v=yUR4Fvx0D3E&list=PLFOIsHSSYIK3Dd3Y_x7itJT1NUKT5SxDh&index=5>`__
50-
5117
.. contents:: Table of Contents
5218
:local:
5319
:depth: 2
@@ -59,15 +25,11 @@ This site documents Operations, Administration, and Development of MinIO Communi
5925

6026
.. todo: More marketing/SEO below?
6127
62-
MinIO officially supports the following platforms:
63-
64-
This site documents Operations, Administration, and Development of MinIO deployments on Red Hat Kubernetes distributions for the latest stable version of the MinIO Operator: |operator-version-stable|.
65-
66-
.. important::
28+
.. important::
6729

68-
Support for deploying the MinIO Operator via the RedHat Marketplace or OperatorHub was removed in 2024.
69-
MinIO AIStor fully supports installation via the Marketplace and OperatorHub onto enterprise RedHat Kubernetes distributions like OpenShift Container Platform (OCP).
70-
|subnet| customers can open an issue for further clarification and instructions on migrating to `AIStor <https://min.io/product/aistor-overview?jmp=docs>`__.
30+
Support for deploying the MinIO Operator via the RedHat Marketplace or OperatorHub was removed in 2024.
31+
MinIO AIStor fully supports installation via the Marketplace and OperatorHub onto enterprise RedHat Kubernetes distributions like OpenShift Container Platform (OCP).
32+
|subnet| customers can open an issue for further clarification and instructions on migrating to `AIStor <https://min.io/product/aistor-overview?jmp=docs>`__.
7133

7234
Quickstart
7335
----------
@@ -103,7 +65,7 @@ Quickstart
10365

10466
1. Download the MinIO Server Process for your Operating System
10567

106-
Follow the instructions on the `MinIO Download Page <https://min.io/downloads?ref=docs>` for your operating system to download and install the :mc:`minio server` process.
68+
Follow the instructions on the `MinIO Download Page <https://min.io/downloads?ref=docs>`__ for your operating system to download and install the :mc:`minio server` process.
10769

10870
2. Create a folder for use with MinIO
10971

‎source/operations/deployments/baremetal-deploy-minio-server.rst

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ Install the MinIO Server
1212

1313
MinIO supports deploying onto baremetal infrastructure - physical machines or virtualized hosts - running Linux, MacOS, and Windows.
1414

15-
TODO conceptual information here
16-
1715
.. toctree::
1816
:titlesonly:
1917
:hidden:

0 commit comments

Comments
 (0)