Minio web console redirects to random high port

[Hr46ph]

I deployed Minio on my Kubernetes cluster. The cluster is setup with Talos, 6 nodes, 3 workers. I setup MetalLB and Nginx-ingress controller. For the latter I followed the blog on Nginx website that sets up cert-manager along the way. I also followed along with the cafe test. This all works fine.

Next I setup NFS storage using nfs-subdir-external-provisioner installed via Helm. I tested that with a pod and pvc and also seems to work fine.

FInally, I setup Minio. I adapted the manifest to deploy it in its own namespace and use a pvc I prepared. The latter works also, I can see the directories and files for Minio config being created. Minio starts, describe shows no weird events. On a sidenote, it gets a certificate! 😄

Now, when I access the Minio gui, it loads for a second or two and shows a page not found. In the address bar, it redirected to some high port, https://minio.svc.k8s.domain.net:40625/.

When I force it to the login page, https://minio.svc.k8s.privatebits.net/login, it does not redirect but shows me the following (and loads instantly):

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied.</Message>
<BucketName>login</BucketName>
<Resource>/login</Resource>
<RequestId>17A5EF7AD1AEB59C</RequestId>
<HostId>dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8</HostId>
</Error>

As for logging, this is the important parts that I see. The ingress-controller logs shows GET /login HTTP/1.1" 403 289 when I force the login page. When it redirects it shows GET / HTTP/1.1" 307 78.

I can post all the manifests etc, but that would create a monster post that nobody wants to plow through. Figured I would post this first and see what extra information is required. At this point Im not sure what would be useful.

Hopefully someone can help me troubleshoot this so I learn something and can proceed. I'm kind of stuck at the moment not because I need Minio perse, but I need to migrate a whole bunch of Docker containers from a standalone host to this cluster that will suffer the same if I don't understand this.

Thanks in advance, wouild really appreciate some assistance 😺 .

[brianehlert]

Strictly speculation.
But I would guess that https://minio.svc.k8s.domain.net:40625/ represents the minio service itself being published as NodePort and not behind the ingress controller.

We would need to see your configuration resources.

I am assuming that you should have this traffic flow:
client -> metallb -> ingress controller -> minio

Which means that the ingress controller should have an Ingress or VirtualServer resource configured with the hostname minio.svc.k8s.domain.net and some port (assume 80/443 by default)

[Hr46ph]

Thanks for the reply. I'm in the middle of setting up a whole lotta things on Kubernetes. One of these days I'll spend more time with Minio and give it another shot. If it still doesn't work I'll come back with more info.