can not access tenant console

[jr0dd]

I am using the latest version of the chart and can not access the tenant console. I have an ingress configured for the operator console and can access that. When I click on "Manage Tenant" I get an error 500. I get this whether I try accessing it through the ingress or kubectl port-forward to the operator console. When I do a kubectl port-forward to the tenant, I get the login screen, but it does not accept the accesskey/secretkey specified in the chart. I have attempted with autocert true and false. One thing I notice is that the MINIO_ROOT_USER & MINIO_ROOT_PASSWORD vars are not set on the operator-console pod and there is no option in the chart to populate env vars on the console only the tenant.

browser error:

Refused to display 'http://localhost:9090/api/proxy/minio/tenant0/' in a frame because it set 'X-Frame-Options' to 'DENY'.

Refused to display 'https://minio.${SECRET_DOMAIN}/api/proxy/minio/tenant0/' in a frame because it set 'X-Frame-Options' to 'DENY'.

operator-console logs:

2021/08/23 15:19:23 couldn't login to tenant and get cookie
2021/08/23 15:27:41 couldn't login to tenant and get cookie

tenant logs:

Status:         4 Online, 0 Offline. 
API: https://minio.minio.svc.cluster.local 

Console: https://minio.${SECRET_DOMAIN} 

Documentation: https://docs.min.io

values.yaml

console:
  ingress:
    enabled: true
    ingressClass: traefik
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-production
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
    host: "minio.${SECRET_DOMAIN}"
    path: /
    tls:
      - secretName: minio-tls
        hosts:
          - "minio.${SECRET_DOMAIN}"
tenants:
  - name: tenant0
    namespace: minio
    image:
      repository: minio/minio
      tag: RELEASE.2021-08-20T18-32-01Z
    pools:
      - servers: 1
        volumesPerServer: 4
        size: 10Gi
        storageClassName: openebs-zfspv
    secrets:
      enabled: true
      name: minio-creds
      accessKey: "${MINIO_ACCESS_KEY}"
      secretKey: "${MINIO_SECRET_KEY}"
    metrics:
      enabled: true
      port: 9000
    certificate:
      requestAutoCert: true
    s3:
      bucketDNS: false

[dvaldivia]

@jr0dd beginning operator v4.2.0 we are deprecating the stand alone .spec.console configuration and stand alone console in favor of the embedded MinIO Console, this will avoid versions mismatches between MinIO and Console, so to solve this issue I recommend you upgrade the MinIO in your tenant to the latest version minio/minio:RELEASE.2021-08-20T18-32-01Z, this will delete the Console Deployment for the tenant, and the Manage Tenant functionality will work again

[jr0dd]

@jr0dd beginning operator v4.2.0 we are deprecating the stand alone .spec.console configuration and stand alone console in favor of the embedded MinIO Console, this will avoid versions mismatches between MinIO and Console, so to solve this issue I recommend you upgrade the MinIO in your tenant to the latest version minio/minio:RELEASE.2021-08-20T18-32-01Z, this will delete the Console Deployment for the tenant, and the Manage Tenant functionality will work again

Right. I know that the tenant console section was removed from the chart. I am using that version of minio with the tenant. Please see my values.yaml in my 1st post

[dvaldivia]

@jr0dd do you see a console pod for that tenant? if you do, can you upgrade that tenant's MinIO version to the latest ? minio/minio:RELEASE.2021-08-20T18-32-01Z

[jr0dd]

# kubectl get pod -n minio
NAME                                      READY   STATUS    RESTARTS   AGE
minio-operator-6bd7dd75c9-7rl8h           1/1     Running   1          122m
tenant0-ss-0-0                            1/1     Running   1          69m
minio-operator-console-5dfb658657-kf96t   1/1     Running   1          122m

# kubectl get svc -n minio
NAME              TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)             AGE
operator          ClusterIP   172.17.20.239   <none>        4222/TCP,4233/TCP   123m
console           ClusterIP   172.17.41.120   <none>        9090/TCP,9443/TCP   123m
tenant0-hl        ClusterIP   None            <none>        9000/TCP            123m
minio             ClusterIP   172.17.6.79     <none>        443/TCP             123m
tenant0-console   ClusterIP   172.17.42.64    <none>        9443/TCP            123m

[jr0dd]

@jr0dd do you see a console pod for that tenant? if you do, can you upgrade that tenant's MinIO version to the latest ? minio/minio:RELEASE.2021-08-20T18-32-01Z

I am already on the latest

tenants:
  - name: tenant0
    namespace: minio
    image:
      repository: minio/minio
      tag: RELEASE.2021-08-20T18-32-01Z

[jr0dd]

@jr0dd do you see a console pod for that tenant? if you do, can you upgrade that tenant's MinIO version to the latest ? minio/minio:RELEASE.2021-08-20T18-32-01Z

is the tenant supposed to create a console service?

[dvaldivia]

@jr0dd yes, the console service is still created, but not the console pod, which browser are you testing with?

[dnskr]

Hi! Looks like I have the same issue.
@jr0dd Try to set a pool as (4 servers X 1 disk) instead of (1 server X 4 disks)
The actual issue from my pov is in MINIO_ENDPOINTS env variable which is generated incorrectly by operator in case of 1 server.
I spent 3 awesome hours trying to find why it doesn't work and I see "Unauthorized" error.

[jr0dd]

@dvaldivia I have tried on firefox and safari

open in new site does nothing

[jr0dd]

Hi! Looks like I have the same issue.
@jr0dd Try to set a pool as (4 servers X 1 disk) instead of (1 server X 4 disks)
The actual issue from my pov is in MINIO_ENDPOINTS env variable which is generated incorrectly by operator in case of 1 server.
I spent 3 awesome hours trying to find why it doesn't work and I see "Unauthorized" error.

oh lovely. so the operator is flipping the vars?

[jr0dd]

fwiw the console also won't let you create a single server tenant

[dvaldivia]

@dnskr we haven't tested 1 server setups thoroughly, only 4x1 setups have been tested

@jr0dd that screen means the console is behind TLS but since you computer doesn't recognize the certificate, for safari, you need to trust the certificate, for firefox you can ask it to ignore the error

[dvaldivia]