Improve TLS configuration instructions

[feorlen]

Update and clarify how to configure TLS for a distributed deployment. The existing steps were out of date, and also were not clear configuration needs to happen on each node.

I'd particularly appreciate comments on terminology. I'm a little fuzzy about how to work with CAs, perhaps some of the phrasing can be improved.

Staged:

• linux
  • http://192.241.195.202:9000/staging/DOCS-447/linux/operations/network-encryption.html
  • http://192.241.195.202:9000/staging/DOCS-447/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html#add-tls-ssl-certificates
    -http://192.241.195.202:9000/staging/DOCS-447/linux/operations/install-deploy-manage/expand-minio-deployment.html#add-tls-ssl-certificates
• k8s
  • http://192.241.195.202:9000/staging/DOCS-447/k8s/operations/network-encryption.html

Closes #447

[feorlen]

What should this filename be? I'm not certain it's actually a pem.

[ravindk89]

Also depends - if it's self-signed, it's going to be a .crt.

We might need to confirm w/ engineering what we expect the keys to be. .pem is a valid wrapper, but I'm not sure if we require .crt

[feorlen]

Poking at the code, I think we expect .crt. Will confirm.

[feorlen]

TODO: summarize the configuration steps near the top of the Network Encryption page (once the technical detail within is confirmed correct).

[ravindk89]

A few followup/s with engineering, after which I'll do another pass for content.

[ravindk89]

Also depends - if it's self-signed, it's going to be a .crt.

We might need to confirm w/ engineering what we expect the keys to be. .pem is a valid wrapper, but I'm not sure if we require .crt

[pjuarezd]

Operator performs the approval of the CSR

https://github.com/minio/operator/blob/371043d388cc1d43e3dec32d0f8bddaae1a3cb81/pkg/controller/csr.go#L119-L123

[pjuarezd]

Is possible to include a section about additional CA's? this is an frequent issue with clients, we usually we share this doc in the repo https://github.com/minio/operator/blob/master/docs/tls.md#using-your-own-ca-certificate-for-minio-operator.

operator-ca-tls

If your MinIO tenants are using custom certificates or certificates generated by your own internal certificate authority (ie: cert-manager). MinIO Operator needs to trust the TLS connections in order to talk to the MinIO tenants, for that you need to create a new secret in the minio-operator namespace named operator-ca-tls, inside this secret create a new key ca.crt that will include the public certificate for your internal certificate authority.

Once the secret is created, operator will create a copy of this secret with the same name in the tenant namespaces.

Whenever a change to the secret operator-ca-tls in the operator namespace is made, the Operator will replicate the change to the secret copy in the tenants namespaces. Operator will replicate the changes to the keys in the secret public.crt, tls.crt and ca.crt.

However operator will not automatically mount the secret operator-ca-tls in the pods, the secret needs to be referenced in the tenant yaml in the externalCaCertSecret property, The pod will have the certificates mounted in the /tmp/certs/CAs/ directory

...
spec:
  externalCaCertSecret:
  - name: operator-ca-tls
    type: kubernetes.io/tls
...

[feorlen]

Is possible to include a section about additional CA's? this is an frequent issue with clients

Can totally add more. Is there anything you would include in addition to that text? @pjuarezd

[djwfyi]

My only added suggestion is to provide some kind of link that can give folks a hint of how to "update MINIO_VOLUMES". Could just be linking to the envvar. But that line occurs many times in these changes, and some link to another resource is warranted.

Other than that, LGTM as far as I know/understand.

[feorlen]

Note: @pjuarezd approved in a separate conversation