multiple MINIO_SERVER_URL values?

[f-lalonde]

Hi! I am currently (I should say finally) updating Minio on my company servers, from the old stand-alone version to the helm pulled one, with everything in a minio-values.yaml style, except a few things, mostly my Ingresses.

My question pertain to an old issue I found no other ways to deal with :
We deal videos to the users using presigned URLs. With the standalone version, we got some problems at some point : when there was many requests (read - more than 8-10, so not that many) to the server, some videos would be locked until another would close. IIRC, it was an issue at the HTTP level. My solution was to create 4 ingresses pointing to the service, and the requests would be sent round-robin style to these ingresses, but I had to create the signature in-software through some rather esoteric code that was already present in there.

Now, unless you guys tell me that this limit on streaming files was a known issue that was fixed, I'd like to know if there is any way that you guys know to assing multiple values to MINIO_SERVER_URL, or a way that would accept the signature created for myminio.mydomain.com/<objectkey> through myminio-2.mydomain.com, myminio-3.mydomain.com, etc.

If none, well, I'll think of something. Just wanted to know if anyone faced a similar issue and had any pro-tips for me.

Thanks!

[f-lalonde]

I've managed to create the signature by myself in my app backend.

[manju-rn]

May I know how have you created the signature? I am in the same boat

I am using linkerd service mesh from one cluster to call the minio server in another, service mesh adds cluster name appended to the service name and hence my minio server url signature mismatches.

[f-lalonde]

I have no idea if you can use what I did, but here's the general idea.
I have a method which receives the key I want to create a token for. Since I don't know which alt the client is going to use, I create a signature for all of them (the for loop in the code), then send it back as a DTO back to the client, which will choose the appropriate one. This works great here because I only have 4 alts, but this might not be scalable.

I also have a list of all the minio alts I have from an external config file. _signer is the AWS signer that I got from the nuget store.
MinioTemporaryCredentials is a custom class, just a POCO with the attributes I want to pass around, and MinioTemporaryCredentialsData is a list of the former class, with data that is the same for all of my alts saved at this level.

The code below is in C#.

public async Task<MinioTemporaryCredentialsData> GenerateTemporaryCredentials(string objectKey)
{
    string policy =	"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"TempRead\",\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\", "s3:GetObjectVersion\"],\"Resource\":\"arn:aws:s3:::" + $"{objectKey}*" + "\"}]}";
    
    string parameters = "Action=AssumeRole" + "&DurationSeconds=" + DefaultDuration + "&Policy=" + policy + "&Version=2011-06-15";
    
    StringContent content = new(parameters, Encoding.UTF8, "application/x-www-form-urlencoded");
    MinioTemporaryCredentialsData minioCredentials = new();


	for (int i = 0; i < _minioAlts.Count ; i++)
	{
		HttpRequestMessage request = new()
		{
			Method = HttpMethod.Post,
			RequestUri = new Uri(_minioAlts[i]),
			Content = new StringContent(parameters, Encoding.UTF8, "application/x-www-form-urlencoded")
		};

		request = await _signer.Sign(request, StsService, DefaultRegion);

		_logger.Trace("MinioClient Trace:\nPolicy : " + policy +"\nParameter : " + parameters + "\nRequest : " + request);
		HttpResponseMessage response = await _httpClient.SendAsync(request);
						

		if (!response.IsSuccessStatusCode)
		{
			return null;
		}

		string responseStr = await response.Content.ReadAsStringAsync();
		byte[] contentBytes = Encoding.UTF8.GetBytes(responseStr);
		using MemoryStream stream = new(contentBytes);
		AssumeRoleResponse result = (AssumeRoleResponse)new XmlSerializer(typeof(AssumeRoleResponse)).Deserialize(stream);

		MinioTemporaryCredentials mtc = new(
			accessKey : result.AssumeRoleResult.Credentials.AccessKeyId,
			secretKey : result.AssumeRoleResult.Credentials.SecretAccessKey,
			sessionToken : result.AssumeRoleResult.Credentials.SessionToken
		);

		minioCredentials.minioTemporaryCredentials.Add(mtc);
		minioCredentials.expiration = result.AssumeRoleResult.Credentials.Expiration;
			}

	return minioCredentials;
}

The layout of my indentation may be screwed and I'm a bit lazy, but I think this should give you the general idea. Just make sure to grab the AWS signer from the package store of your language of choice and you should be able to whip something up. Godspeed!

[manju-rn]

Ah Nice! Let me understand this in bit more detail and i think i can recreate.

However, not sure why minio is so focussed on signature generation via 1 url only. Security issue can be better handled via network connectivity protocol rather than handling at application side. Hope they allow additional entries in SERVER_URL or actually doing away with hostname as signatures at all - they already have access key