<p>I run Minio on a kubernetes cluster since May. Everything worked fine. Since the last action, updated ingress from Traefik to Nginx ingress, I cannot login to the Minio Console anymore.</p>
<p>I do not really know if this happen before or after the ingress update. But in all I think this is not the reason.</p>
<p>The secret is still there in the cluster and it looks well.</p>
<p>The common Minio login to browse the buckets works perfect. But not the Minio Console.</p>
<p>The pod is always writing in the pod log (Lens):</p>
<pre><code>2021-11-29 22:01:17.806356 I | 2021/11/29 22:01:17 operator.go:73: the server has asked for the client to provide credentials
2021-11-29 22:01:17.806384 I | 2021/11/29 22:01:17 error.go:44: original error: invalid Login
</code></pre>
<p>No word about an error, but always <code>Unauthorized</code> inside the login screen. Anybody here with a similar problem in the past?</p>

<p><strong>Solution 1:</strong></p>
<p>The auth issue can be faced due to an expired <code>apiserver-kubelet-client.crt</code>. If it's expired, try to renew the cert and restart the apiserver.</p>
<p>In order to do this:</p>
<ul>
<li>check if the cert is expired</li>
<li>remove expired certificates(.crt)</li>
<li>execute <code>kubeadm alpha phase certs all</code></li>
</ul>
<p>Note this:</p>
<pre><code># for kube-apiserver
--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key

# for kubelet
--client-ca-file=/etc/kubernetes/pki/ca.crt
</code></pre>
<p><strong>Solution 2:</strong></p>
<p>While you've deployed cluster on Kubernetes before, you've should created Kubernetes manifest. You can try to delete them(service account, role, rolebinding) and create them once again:</p>
<ul>
<li>Remove Service Account:</li>
</ul>
<p><code>kubectl delete serviceaccount --namespace NAMESPACE_NAME SERVICEACCOUNT_NAME</code></p>
<ul>
<li>Remove Cluter Role Binding:</li>
</ul>
<p><code>kubectl delete clusterrolebinding CLUSTERROLEBINDING_NAME</code></p>
<ul>
<li>Remove Minio directory:</li>
</ul>
<p><code>rm -rf ./minio</code></p>
<ul>
<li>Create the Service Account, Role, RoleBinding:</li>
</ul>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: minio-serviceaccount
  labels:
    app: minio

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: minio-role
  labels:
    app: minio
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - secrets
  resourceNames:
  - &quot;minio-keys&quot;
  verbs:
  - get

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: minio-role-binding
  labels:
    app: minio
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: minio-role
subjects:
- kind: ServiceAccount
  name: minio-serviceaccount
</code></pre>
<blockquote>
<p>Make sure that the Minio pods can access the Minio keys stored in the previously created Secret or create new secrets.</p>
</blockquote>
<ul>
<li>Run helm init command:</li>
</ul>
<p><code>helm init --service-account=minio-serviceaccount</code></p>
<ul>
<li><p>Recreate your Minio pod</p>
</li>
<li><p>Reinstall the charts</p>
</li>
</ul>
