mounting Operator CA in minio not longer required

[cniackz]

Objective:

To avoid mounting Operator's CA into MinIO if not required.

Explanation:

This is the continuation of #1437 because of those changes, Tenants no longer need to communicate with Operator webservers over TLS to get startup arguments or create bucket DNS. Also when using cert-manager we don't need to use this CA certificate in the tenant as cert-manager is already doing this for us; so this is redundant, look:

Related PRs:

• No more operator tls #1515
• Introduce Sidecar Args #1437

Related issues:

• tenant install failed - references non-existent secret key: public.crt #1839 it will partially fix this issue as MinIO container will not mount the CA anymore but another code fix is needed to avoid propagating the secret with the CA, we can handle that in a different PR.

Question:

And if it is required, why? and where? as I can't find a reason for these lines anymore.

[pjuarezd]

Operator still needs to trust the tenants CA to hit the healtchcheck endpoint, specially when a custom certificate is provided to tenants, as long as operator-ca-tls secret is not deprecated and we can still mount it in Operator this is OK.

[cniackz]

Operator still needs to trust the tenants CA to hit the healtchcheck endpoint <--- Yes this is true, and in the case of cert-manager, we do have instructions on how to do this and it works!.

[cniackz]

operator-ca-tls is not deprecated and is still needed, this PR is only avoiding the mount of the CA in this secret as is not needed.

[cniackz]

...we can still mount it in Operator this is OK.

Yes, we can still mount it in operator

[cniackz]

I am just waiting for tests to pass to ask for a review

[feorlen]

What would make sense to say in the docs? Specifically I'm thinking the sections that include this information, perhaps other locations as well.

https://min.io/docs/minio/kubernetes/upstream/operations/installation.html#kubernetes-tls-certificate-api

The MinIO Operator reads certificates inside the operator-ca-tls secret and syncs this secret within the tenant namespace to trust private certificate authorities, such as when using cert-manager.

https://min.io/docs/minio/kubernetes/upstream/operations/network-encryption.html#self-signed-internal-and-private-certificates

Once the secret is created, Operator creates a copy in each tenant namespace and mounts its certificates in the tenant pods at /tmp/certs/CAs/.

[ravindk89]

If I'm reading the code right @feorlen , this would actually eliminate that behavior entirely.

Moving forward, operator-ca-tls is required in general if using self-signed, internal, private, or public CAs that require intermediate certs. But we no longer need to extract or move certs to the Tenant at all.

The Tenant has what it needs already. The Operator only needs a copy of the CA, wherever that lives.

[feorlen]

But we no longer need to extract or move certs to the Tenant at all. The Tenant has what it needs already. The Operator only needs a copy of the CA, wherever that lives.

We can condense the current detail and say it's no longer a concern starting with version whatever. Yay. One less thing for people to think about.

[jiuker]

LGTM