<p>I'm experimenting with kubernetes and a minio deployment. I have a k3s 4 node cluster, each one with 4 50GB disk. Following the instructions <a href="https://docs.min.io/minio/k8s/tenant-management/deploy-minio-tenant-using-commandline.html" rel="nofollow noreferrer">here</a> I have done this:</p>
<ol>
<li><p>First I installed <a href="https://krew.sigs.k8s.io/docs/user-guide/setup/install/" rel="nofollow noreferrer">krew</a> in order to install the <a href="https://docs.min.io/minio/k8s/deployment/deploy-minio-operator.html#deploy-operator-kubernetes" rel="nofollow noreferrer">minio</a> and the <a href="https://github.com/minio/directpv/blob/master/README.md" rel="nofollow noreferrer">directpv</a> operators.</p>
</li>
<li><p>I installed those two without a problem.</p>
</li>
<li><p>I formatted every <strong>Available</strong> hdd in the node using <code>kubectl directpv drives format --drives /dev/vd{b...e} --nodes k3s{1...4}</code></p>
</li>
<li><p>I then proceed to make the deployment, first I create the namespace with <code>kubectl create namespace minio-tenant-1</code>, and then I actually create the tenant with:</p>
<p><code>kubectl minio tenant create minio-tenant-1 --servers 4 --volumes 8 --capacity 10Gi --storage-class direct-csi-min-io --namespace minio-tenant-1</code></p>
</li>
<li><p>The only thing I need to do then is expose the port to access, which I do with: <code>kubectl port-forward service/minio 443:443</code> (I'm guessing it should be a better way to achieve this, as the last command isn't apparently permanent, maybe using a LoadBalancer or NodePort type services in the kubernetes cluster).</p>
</li>
</ol>
<p>So far so good, but I'm facing some problems:</p>
<ul>
<li>When I try to create an alias to the server using <a href="https://docs.min.io/docs/minio-client-complete-guide.html" rel="nofollow noreferrer">mc</a> the prompt answer me back with:</li>
</ul>
<blockquote>
<p>mc:  Unable to initialize new alias from the provided
credentials. Get
&quot;https://127.0.0.1/probe-bucket-sign-9aplsepjlq65/?location=&quot;: x509:
cannot validate certificate for 127.0.0.1 because it doesn't contain
any IP SANs</p>
</blockquote>
<p>I can surpass this with simply adding the <code>--insecure</code> option, but I don't know why it throws me this error, I guess is something how k3s manage the TLS auto-signed certificates.</p>
<ul>
<li><p>Once created the alias (I named it test) of the server with the <code>--insecure</code> option I try to create a bucket, but the server always answer me back with:</p>
<p><code>mc mb test/hello</code></p>
<p><code>mc: &lt;ERROR&gt; Unable to make bucket \test/hello. The specified bucket does not exist.</code></p>
</li>
</ul>
<p>So... I can't really use it... Any help will be appreciated, I need to know what I'm doing wrong.</p>

<p>Guided by information at the <a href="https://docs.min.io/docs/how-to-secure-access-to-minio-server-with-tls.html" rel="nofollow noreferrer">Minio documentation</a>. You have to generate a public certificate. First of all generate a private key use command:</p>
<pre><code>certtool.exe --generate-privkey --outfile NameOfKey.key
</code></pre>
<p>After that create a file called <code>cert.cnf</code> with content below:</p>
<pre><code># X.509 Certificate options
#
# DN options

# The organization of the subject.
organization = &quot;Example Inc.&quot;

# The organizational unit of the subject.
#unit = &quot;sleeping dept.&quot;

# The state of the certificate owner.
state = &quot;Example&quot;

# The country of the subject. Two letter code.
country = &quot;EX&quot;

# The common name of the certificate owner.
cn = &quot;Sally Certowner&quot;

# In how many days, counting from today, this certificate will expire.
expiration_days = 365

# X.509 v3 extensions

# DNS name(s) of the server
dns_name = &quot;localhost&quot;

# (Optional) Server IP address
ip_address = &quot;127.0.0.1&quot;

# Whether this certificate will be used for a TLS server
tls_www_server
</code></pre>
<p>Run <code>certtool.exe</code> and specify the configuration file to generate a certificate:</p>
<pre><code>certtool.exe --generate-self-signed --load-privkey NameOfKey.key --template cert.cnf --outfile public.crt
</code></pre>
<p>And the end put the public certificate into:</p>
<pre><code>~/.minio/certs/CAs/
</code></pre>
