diff --git a/source/_templates/platform-navigation.html b/source/_templates/platform-navigation.html
index 8fc047684..4807c1871 100644
--- a/source/_templates/platform-navigation.html
+++ b/source/_templates/platform-navigation.html
@@ -1,27 +1,7 @@
diff --git a/source/administration/console/security-and-access.rst b/source/administration/console/security-and-access.rst
index 8694db861..42301323c 100644
--- a/source/administration/console/security-and-access.rst
+++ b/source/administration/console/security-and-access.rst
@@ -1,7 +1,7 @@
-
-
.. _minio-console-security-access:
+
:orphan:
+
===================
Security and Access
===================
diff --git a/source/administration/identity-access-management/pluggable-authentication.rst b/source/administration/identity-access-management/pluggable-authentication.rst
index 0106ccbbb..3463aa6e2 100644
--- a/source/administration/identity-access-management/pluggable-authentication.rst
+++ b/source/administration/identity-access-management/pluggable-authentication.rst
@@ -75,7 +75,7 @@ The login flow for an application is as follows:
{
"user": "
",
"maxValiditySeconds": 3600,
- "claims": "KEY=VALUE,[KEY=VALUE,...]"
+ "claims": {"KEY": "VALUE", ...}
}
.. list-table::
@@ -90,7 +90,7 @@ The login flow for an application is as follows:
- The maximum allowed expiry duration for the returned credentials
* - ``claims``
- - A list of key-value pair claims associated with the requested credentials.
+ - A JSON string of ``"key": "value"`` pair claims associated with the requested credentials.
MinIO reserves and ignores the ``exp``, ``parent``, and ``sub`` claims objects if present.
4. MinIO returns a response to the STS API request that includes temporary credentials for use with making authenticated requests.
diff --git a/source/administration/identity-access-management/policy-based-access-control.rst b/source/administration/identity-access-management/policy-based-access-control.rst
index 7e9e0cf3f..2f2f08f40 100644
--- a/source/administration/identity-access-management/policy-based-access-control.rst
+++ b/source/administration/identity-access-management/policy-based-access-control.rst
@@ -970,7 +970,7 @@ To select all of the available kms policy actions, use ``kms:*``.
For example, the following policy document allows a user to list keys, create new keys, and check the status of keys for any resource that begins with ``keys-abc-`` or ``myuser-``.
- .. codeblock:: shell
+ .. code-block:: shell
:class: copyable
{
diff --git a/source/administration/object-management.rst b/source/administration/object-management.rst
index b61815fe1..0ae736d80 100644
--- a/source/administration/object-management.rst
+++ b/source/administration/object-management.rst
@@ -97,11 +97,6 @@ Administrators typically control the creation and configuration of buckets.
Client applications can then use :ref:`S3-compatible SDKs ` to create, list, retrieve, and :ref:`delete ` objects on the MinIO deployment.
Clients therefore drive the overall hierarchy of data within a given bucket or prefix, where Administrators can exercise control using :ref:`policies ` to grant or deny access to an action or resource.
-.. cond:: windows
-
- MinIO does not support the ``\`` or ``:`` characters in object names, regardless of support for those characters in Windows filesystems.
- Use ``/`` as a delimiter in object names to have MinIO automatically create a folder structure using :term:`prefixes `.
-
MinIO has no hard :ref:`thresholds ` on the number of buckets, objects, or prefixes on a given deployment.
The relative performance of the hardware and networking underlying the MinIO deployment may create a practical limit to the number of objects in a given prefix or bucket.
Specifically, hardware using slower drives or network infrastructures tend to exhibit poor performance in buckets or prefixes with a flat hierarchy of objects.
@@ -117,8 +112,13 @@ Consider the following points as general guidance for client applications worklo
For a deeper discussion on the benefits of limiting prefix contents, see the article on :s3-docs:`optimizing S3 performance `.
+.. note::
+
+ MinIO does not support the ``\`` or ``:`` characters in object names, regardless of support for those characters in Windows filesystems.
+ Use ``/`` as a delimiter in object names to have MinIO automatically create a folder structure using :term:`prefixes `.
+
Object Versioning
------------------
+-----------------
.. image:: /images/retention/minio-versioning-multiple-versions.svg
:alt: Object with Multiple Versions
diff --git a/source/default-conf.py b/source/default-conf.py
index 7d5ac30d6..8c3d78ebe 100644
--- a/source/default-conf.py
+++ b/source/default-conf.py
@@ -71,6 +71,7 @@
'eks-docs' : ('https://docs.aws.amazon.com/eks/latest/userguide/%s', None),
'minio-web' : ('https://min.io/%s?ref=docs', None),
'minio-docs' : ('https://min.io/docs/%s?ref=docs-internal', None),
+ 'minio-blog' : ('https://blog.min.io/%s?ref=docs', None),
'gke-docs' : ('https://cloud.google.com/kubernetes-engine/docs/%s', None),
'gcp-docs' : ('https://cloud.google.com/compute/docs/%s', None),
'gcs-docs' : ('https://cloud.google.com/storage/docs/%s', None),
@@ -106,78 +107,6 @@
excludes = []
-if tags.has("linux"):
- html_baseurl = 'https://min.io/docs/minio/linux/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'linux':
- excludes = i['excludes']
- break
-
-elif tags.has("macos"):
- html_baseurl = 'https://min.io/docs/minio/macos/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'macos':
- excludes = i['excludes']
- break
-
-elif tags.has("windows"):
- # html_baseurl is used for generating the sitemap.xml for each platform. These are combined in a sitemapindex.xml.
- html_baseurl = 'https://min.io/docs/minio/windows/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'windows':
- excludes = i['excludes']
- break
-
-elif tags.has("container"):
- html_baseurl = 'https://min.io/docs/minio/container/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'container':
- excludes = i['excludes']
- break
-
-elif tags.has("k8s") and not (tags.has("openshift") or tags.has("eks") or tags.has("gke") or tags.has("aks")):
- html_baseurl = 'https://min.io/docs/minio/kubernetes/upstream/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'k8s':
- excludes = i['excludes']
- break
-
-elif tags.has("openshift"):
- html_baseurl = 'https://min.io/docs/minio/kubernetes/openshift/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'openshift':
- excludes = i['excludes']
- break
-
-elif tags.has("eks"):
- html_baseurl = 'https://min.io/docs/minio/kubernetes/eks/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'eks':
- excludes = i['excludes']
- break
-
-elif tags.has("gke"):
- html_baseurl = 'https://min.io/docs/minio/kubernetes/gke/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'gke':
- excludes = i['excludes']
- break
-
-elif tags.has("aks"):
- html_baseurl = 'https://min.io/docs/minio/kubernetes/aks/'
- with open('url-excludes.yaml','r') as f:
- for i in (yaml.safe_load_all(f)):
- if i['tag'] == 'aks':
- excludes = i['excludes']
- break
exclude_patterns.extend(excludes)
@@ -246,56 +175,20 @@
# Add https://www.min.io/robots.txt to html_extra_path list once available.
html_extra_path = [ 'extra']
-# -- Project information -----------------------------------------------------
-
-# We assume a single tag, since we control the builder
-
-platform = list(tags.tags.keys())[0]
+html_baseurl = 'https://docs.min.io/community/minio-object-store'
-platform_fmt = ""
+# -- Project information -----------------------------------------------------
-if platform == "k8s":
- platform_fmt = "Kubernetes"
-elif platform == "macos":
- platform_fmt = "MacOS"
-elif platform == "openshift":
- platform_fmt = "OpenShift"
-elif platform == "eks":
- platform_fmt = "Elastic Kubernetes Service"
-elif platform == "gke":
- platform_fmt = "Google Kubernetes Engine"
-elif platform == "aks":
- platform_fmt = "Azure Kubernetes Service"
-else:
- platform_fmt = platform.capitalize()
-project = 'MinIO Documentation for ' + platform_fmt
+project = 'Documentation for MinIO Object Storage'
copyright = '2020-Present, MinIO, Inc. '
author = 'MinIO Documentation Team'
-html_title = 'MinIO Object Storage for ' + platform_fmt
-html_short_title = 'MinIO Object Storage for ' + platform_fmt
+html_title = 'MinIO Object Storage (AGPLv3)'
+html_short_title = 'MinIO Object Storage'
html_permalinks_icon = ''
html_context = {
- 'doc_platform': platform.lower(),
- 'docs': [
- # The first item has to be the current docs site #
- {
- 'name': 'MinIO Server',
- 'current': True
- },
- {
- 'name': 'DirectPV',
- 'url': 'https://min.io/docs/directpv',
- 'external': True
- },
- {
- 'name': 'KES',
- 'url': 'https://min.io/docs/kes',
- 'external': True
- }
- ]
}
# -- Options for Sphinx Tabs -------------------------------------------------
@@ -306,14 +199,9 @@
# k8s is temporary until integrating the references here
-intersphinx_mapping = {
- 'linux' : ('https://min.io/docs/minio/linux/', None),
- 'kubernetes' : ('https://min.io/docs/minio/kubernetes/upstream/',None)
-}
-
rst_prolog = """
-.. |platform| replace:: %s
+.. |platform| replace:: 'foo'
.. |podman| replace:: `Podman `__
@@ -323,10 +211,18 @@
.. |minio-latest| replace:: MINIOLATEST
.. |minio-rpm| replace:: RPMURL
.. |minio-deb| replace:: DEBURL
-.. |minio-rpmarm64| replace:: RPMARM64URL
-.. |minio-debarm64| replace:: DEBARM64URL
-.. |subnet| replace:: `MinIO pricing `__
-.. |subnet-short| replace:: `pricing `__
+.. |minio-binary| replace:: MINIOURL
+.. |minio-rpm-arm64| replace:: RPMARM64URL
+.. |minio-deb-arm64| replace:: DEBARM64URL
+.. |minio-binary-arm64| replace:: MINIOARM64URL
+.. |minio-rpm-ppc64le| replace:: RPMPPC64LEURL
+.. |minio-deb-ppc64le| replace:: DEBPPC64LEURL
+.. |minio-binary-ppc64le| replace:: MINIOPPC64LEURL
+.. |minio-rpms-390x| replace:: RPMS390XURL
+.. |minio-debs-390x| replace:: DEBS390XURL
+.. |minio-binarys-390x| replace:: MINIOS390XURL
+.. |subnet| replace:: `MinIO SUBNET `__
+.. |subnet-short| replace:: `SUBNET `__
.. |SNSD| replace:: :abbr:`SNSD (Single-Node Single-Drive)`
.. |SNMD| replace:: :abbr:`SNMD (Single-Node Multi-Drive)`
.. |MNMD| replace:: :abbr:`MNMD (Multi-Node Multi-Drive)`
@@ -348,4 +244,4 @@
.. |rust-sdk-version| replace:: RUSTVERSION
-""" % platform_fmt
+"""
diff --git a/source/design.rst b/source/design.rst
index 9f09e8889..4e472589d 100644
--- a/source/design.rst
+++ b/source/design.rst
@@ -219,7 +219,7 @@ Grids
Header 1
--------
-.. cond:: linux
+.. cond:: mindocs
.. include:: /includes/common/common-design.rst
diff --git a/source/developers/file-transfer-protocol.rst b/source/developers/file-transfer-protocol.rst
index 3148cc9d0..fa729eba6 100644
--- a/source/developers/file-transfer-protocol.rst
+++ b/source/developers/file-transfer-protocol.rst
@@ -12,13 +12,211 @@ File Transfer Protocol (FTP/SFTP)
.. contents:: Table of Contents
:local:
- :depth: 1
+ :depth: 2
-.. cond:: not k8s
+.. tab-set::
- .. include:: /includes/linux/file-transfer-protocol-not-k8s.rst
+ .. tab-item:: Kubernetes
+ :sync: k8s
-.. cond:: k8s and not (openshift or eks or gke or aks)
+ Starting with Operator 5.0.7 and :minio-release:`MinIO Server RELEASE.2023-04-20T17-56-55Z `, you can use the SSH File Transfer Protocol (SFTP) to interact with the objects on a MinIO Operator Tenant deployment.
- .. include:: /includes/k8s/file-transfer-protocol-k8s.rst
+ SFTP is defined by the Internet Engineering Task Force (IETF) as an extension of SSH 2.0.
+ It allows file transfer over SSH for use with :ref:`Transport Layer Security (TLS) ` and virtual private network (VPN) applications.
+
+ Enabling SFTP does not affect other MinIO features.
+
+ .. tab-item:: Baremetal
+ :sync: baremetal
+
+ Starting with :minio-release:`MinIO Server RELEASE.2023-04-20T17-56-55Z `, you can use the File Transfer Protocol (FTP) to interact with the objects on a MinIO deployment.
+
+ You must specifically enable FTP or SFTP when starting the server.
+ Enabling either server type does not affect other MinIO features.
+
+ This page uses the abbreviation FTP throughout, but you can use any of the supported FTP protocols described below.
+
+Supported Protocols
+-------------------
+
+.. tab-set::
+
+ .. tab-item:: Kubernetes
+ :sync: k8s
+
+ The MinIO Operator only supports configuring SSH File Transfer Protocol (SFTP).
+
+ .. tab-item:: Baremetal
+ :sync: baremetal
+
+ When enabled, MinIO supports FTP access over the following protocols:
+
+ - SSH File Transfer Protocol (SFTP)
+
+ SFTP is defined by the Internet Engineering Task Force (IETF) as an extension of SSH 2.0.
+ SFTP allows file transfer over SSH for use with :ref:`Transport Layer Security (TLS) ` and virtual private network (VPN) applications.
+
+ Your FTP client must support SFTP.
+
+ - File Transfer Protocol over SSL/TLS (FTPS)
+
+ FTPS allows for encrypted FTP communication with TLS certificates over the standard FTP communication channel.
+ FTPS should not be confused with SFTP, as FTPS does not communicate over a Secure Shell (SSH).
+
+ Your FTP client must support FTPS.
+
+ - File Transfer Protocol (FTP)
+
+ Unencrypted file transfer.
+
+ MinIO does **not** recommend using unencrypted FTP for file transfer.
+
+Supported Commands
+------------------
+
+When enabled, MinIO supports the following SFTP operations:
+
+- ``get``
+- ``put``
+- ``ls``
+- ``mkdir``
+- ``rmdir``
+- ``delete``
+
+MinIO does not support either ``append`` or ``rename`` operations.
+
+Considerations
+--------------
+
+Versioning
+~~~~~~~~~~
+
+SFTP clients can only operate on the :ref:`latest version ` of an object.
+Specifically:
+
+- For read operations, MinIO only returns the latest version of the requested object(s) to the SFTP client.
+- For write operations, MinIO applies normal versioning behavior and creates a new object version at the specified namespace.
+ ``rm`` and ``rmdir`` operations create ``DeleteMarker`` objects.
+
+Authentication and Access
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+SFTP access requires the same authentication as any other S3 client.
+MinIO supports the following authentication providers:
+
+- :ref:`MinIO IDP ` users and their service accounts
+- :ref:`Active Directory/LDAP ` users and their service accounts
+- :ref:`OpenID/OIDC ` service accounts
+
+:ref:`STS ` credentials **cannot** access buckets or objects over SFTP.
+
+Authenticated users can access buckets and objects based on the :ref:`policies ` assigned to the user or parent user account.
+
+The SFTP protocol does not require any of the ``admin:*`` :ref:`permissions `.
+You may not perform other MinIO admin actions with SFTP.
+
+Prerequisites
+-------------
+
+.. tab-set::
+
+ .. tab-item:: Kubernetes
+ :sync: k8s
+
+ - MinIO Operator v5.0.7 or later.
+ - Enable an SFTP port (8022) for the server.
+ - A port to use for the SFTP commands and a range of ports to allow the SFTP server to request to use for the data transfer.
+
+ .. tab-item:: Baremetal
+ :sync: baremetal
+
+ - MinIO RELEASE.2023-04-20T17-56-55Z or later.
+ - Enable an FTP or SFTP port for the server.
+ - A port to use for the FTP commands and a range of ports to allow the FTP server to request to use for the data transfer.
+
+Procedure
+---------
+
+.. tab-set::
+
+ .. tab-item:: Kubernetes
+ :sync: k8s
+
+ .. include:: /includes/k8s/file-transfer-protocol-k8s.rst
+
+ .. tab-item:: Baremetal
+ :sync: baremetal
+
+ .. include:: /includes/linux/file-transfer-protocol-not-k8s.rst
+
+.. _minio-certificate-key-file-sftp-k8s:
+
+Connect to MinIO Using SFTP with a Certificate Key File
+-------------------------------------------------------
+
+.. versionadded:: RELEASE.2024-05-07T06-41-25Z
+
+
+MinIO supports mutual TLS (mTLS) certificate-based authentication on SFTP, where both the server and the client verify the authenticity of each other.
+
+This type of authentication requires the following:
+
+1. Public key file for the trusted certificate authority
+2. Public key file for the MinIO Server minted and signed by the trusted certificate authority
+3. Public key file for the user minted and signed by the trusted certificate authority for the client connecting by SFTP and located in the user's ``.ssh`` folder (or equivalent for the operating system)
+
+The keys must include a `principals list `__ of the user(s) that can authenticate with the key:
+
+.. code-block:: shell
+ :class: copyable
+
+ ssh-keygen -s ~/.ssh/ca_user_key -I miniouser -n miniouser -V +1h -z 1 miniouser1.pub
+
+- ``-s`` specifies the path to the certificate authority public key to use for generating this key.
+ The specified public key must have a ``principals`` list that includes this user.
+- ``-I`` specifies the key identity for the public key.
+- ``-n`` creates the ``user principals`` list for which this key is valid.
+ You must include the user for which this key is valid, and the user must match the username in MinIO.
+- ``-V`` limits the duration for which the generated key is valid.
+ In this example, the key is valid for one hour.
+ Adjust the duration for your requirements.
+- ``-z`` adds a serial number to the key to distinguish this generated public key from other keys signed by the same certificate authority public key.
+
+MinIO requires specifying the Certificate Authority used to sign the certificates for SFTP access.
+Start or restart the MinIO Server and specify the path to the trusted certificate authority's public key using an ``--sftp="trusted-user-ca-key=PATH"`` flag:
+
+.. code-block:: shell
+ :class: copyable
+
+ minio server {path-to-server} --sftp="trusted-user-ca-key=/path/to/.ssh/ca_user_key.pub" {...other flags}
+
+When connecting to the MinIO Server with SFTP, the client verifies the MinIO Server's certificate.
+The client then passes its own certificate to the MinIO Server.
+The MinIO Server verifies the key created above by comparing its value to the the known public key from the certificate authority provided at server startup.
+
+Once the MinIO Server verifies the client's certificate, the user can connect to the MinIO server over SFTP:
+
+.. code-block:: bash
+ :class: copyable:
+
+ sftp -P
+
+Require service account or LDAP for authentication
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To force authentication to SFTP using LDAP or service account credentials, append a suffix to the username.
+Valid suffixes are either ``=ldap`` or ``=svc``.
+
+.. code-block:: console
+
+ > sftp -P 8022 my-ldap-user=ldap@[minio@localhost]:/bucket
+
+
+.. code-block:: console
+
+ > sftp -P 8022 my-ldap-user=svc@[minio@localhost]:/bucket
+
+
+- Replace ``my-ldap-user`` with the username to use.
+- Replace ``[minio@localhost]`` with the address of the MinIO server.
diff --git a/source/developers/security-token-service.rst b/source/developers/security-token-service.rst
index 17c53d155..dcd5bfb1d 100644
--- a/source/developers/security-token-service.rst
+++ b/source/developers/security-token-service.rst
@@ -45,4 +45,5 @@ MinIO supports the following STS API endpoints:
:hidden:
:glob:
- /developers/security-token-service/*
\ No newline at end of file
+ /developers/security-token-service/*
+ /developers/sts-for-operator
diff --git a/source/developers/security-token-service/AssumeRoleWithCustomToken.rst b/source/developers/security-token-service/AssumeRoleWithCustomToken.rst
index 4dd267c2c..912cdb10e 100644
--- a/source/developers/security-token-service/AssumeRoleWithCustomToken.rst
+++ b/source/developers/security-token-service/AssumeRoleWithCustomToken.rst
@@ -67,6 +67,9 @@ This endpoint supports the following query parameters:
See :envvar:`MINIO_IDENTITY_PLUGIN_ROLE_ID` or :mc-conf:`identity_plugin role_id ` for more information.
+ Note that MinIO automatically prepends ``idmp-`` to a configured ``ROLE_ID`` when generating the RoleArn.
+ Include that string with the ``ROLE_ID`` if required.
+
* - ``DurationSeconds``
- integer
- *Optional*
diff --git a/source/includes/aks/deploy-minio-on-azure-kubernetes-service.rst b/source/includes/aks/deploy-minio-on-azure-kubernetes-service.rst
deleted file mode 100644
index 9502f6014..000000000
--- a/source/includes/aks/deploy-minio-on-azure-kubernetes-service.rst
+++ /dev/null
@@ -1,53 +0,0 @@
-
-.. _deploy-operator-gke:
-
-=================================================
-Deploy MinIO Operator on Azure Kubernetes Service
-=================================================
-
-.. default-domain:: minio
-
-.. contents:: Table of Contents
- :local:
- :depth: 1
-
-Overview
---------
-
-`Azure Kubernetes Engine `__ (AKS) is a highly available, secure, and fully managed Kubernetes service from Microsoft Azure.
-The MinIO Kubernetes Operator supports deploying MinIO Tenants onto AKS infrastructure using the MinIO Operator Console or `kustomize `__ for :minio-git:`YAML-defined deployments `.
-
-:minio-web:`Through the AKS Marketplace `
- MinIO maintains an `AKS Marketplace listing `__ through which you can register your AKS cluster with |subnet|.
- Any MinIO tenant you deploy through Marketplace-connected clusters can take advantage of SUBNET registration, including 24/7 access to MinIO engineers.
-
-This page documents deploying the MinIO Operator through the CLI using Kustomize.
-For instructions on deploying the MinIO Operator through the AKS Marketplace, see :minio-web:`Deploy MinIO through AKS `
-
-This documentation assumes familiarity with all referenced Kubernetes and Azure Kubernetes Service concepts, utilities, and procedures.
-While this documentation *may* provide guidance for configuring or deploying Kubernetes-related or Azure Kubernetes Service-related resources on a best-effort basis, it is not a replacement for the official :kube-docs:`Kubernetes Documentation <>`.
-
-Prerequisites
--------------
-
-Existing AKS Cluster
-~~~~~~~~~~~~~~~~~~~~
-
-This procedure assumes an existing :abbr:`AKS (Azure Kubernetes Service)` cluster onto which you can deploy the MinIO Operator.
-
-The Operator by default deploys pods and services with two replicas each and pod anti-affinity.
-The AKS cluster should therefore have at least two nodes available for scheduling Operator pods and services.
-While these nodes *may* be the same nodes intended for use by MinIO Tenants, co-locating Operator and Tenant pods may increase the risk of service interruptions due to the loss of any one node.
-
-``kubectl`` Access to the AKS Cluster
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Ensure your host machine has a ``kubectl`` installation compatible with the target AKS cluster.
-For guidance on connecting ``kubectl`` to AKS, see :aks-docs:`Install kubectl and configure cluster access `.
-
-Procedure
----------
-
-The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
-
-.. include:: /includes/common/common-install-operator-kustomize.rst
diff --git a/source/includes/baremetal/steps-configure-ad-ldap-external-identity-management.rst b/source/includes/baremetal/steps-configure-ad-ldap-external-identity-management.rst
new file mode 100644
index 000000000..ecfbe9b14
--- /dev/null
+++ b/source/includes/baremetal/steps-configure-ad-ldap-external-identity-management.rst
@@ -0,0 +1,146 @@
+1. Set the Active Directory / LDAP Configuration Settings
+
+ Configure the AD/LDAP provider using one of the following:
+
+ * MinIO Client
+ * Environment variables
+
+ All methods require starting/restarting the MinIO deployment to apply changes.
+
+ The following tabs provide a quick reference for the available configuration methods:
+
+ .. tab-set::
+
+ .. tab-item:: MinIO Client
+
+ MinIO supports specifying the AD/LDAP provider settings using :mc:`mc idp ldap` commands.
+
+ For distributed deployments, the :mc:`mc idp ldap` command applies the configuration to all nodes in the deployment.
+
+ The following example code sets *all* configuration settings related to configuring an AD/LDAP provider for external identity management.
+ The minimum *required* settings are:
+
+ - :mc-conf:`server_addr `
+ - :mc-conf:`lookup_bind_dn `
+ - :mc-conf:`lookup_bind_password `
+ - :mc-conf:`user_dn_search_base_dn `
+ - :mc-conf:`user_dn_search_filter `
+
+ .. code-block:: shell
+ :class: copyable
+
+ mc idp ldap add ALIAS \
+ server_addr="ldaps.example.net:636" \
+ lookup_bind_dn="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net" \
+ lookup_bind_password="xxxxxxxx" \
+ user_dn_search_base_dn="DC=example,DC=net" \
+ user_dn_search_filter="(&(objectCategory=user)(sAMAccountName=%s))" \
+ group_search_filter= "(&(objectClass=group)(member=%d))" \
+ group_search_base_dn="ou=MinIO Users,dc=example,dc=net" \
+ tls_skip_verify="off" \
+ server_insecure=off \
+ server_starttls="off" \
+ srv_record_name="" \
+ comment="Test LDAP server"
+
+ For Kubernetes deployments, ensure the `ALIAS` corresponds to the externally accessible hostname for the MinIO Tenant.
+
+ For more complete documentation on these settings, see :mc:`mc idp ldap`.
+
+ .. admonition:: :mc:`mc idp ldap` recommended
+ :class: note
+
+ :mc:`mc idp ldap` offers additional features and improved validation over :mc-cmd:`mc admin config set` runtime configuration settings.
+ :mc:`mc idp ldap` supports the same settings as :mc:`mc admin config` and the :mc-conf:`identity_ldap` configuration key.
+
+ The :mc-conf:`identity_ldap` configuration key remains available for existing scripts and tools.
+
+ .. tab-item:: Environment Variables
+
+ MinIO supports specifying the AD/LDAP provider settings using :ref:`environment variables `.
+ The :mc:`minio server` process applies the specified settings on its next startup.
+ For distributed deployments, specify these settings across all nodes in the deployment using the *same* values.
+ Any differences in server configurations between nodes will result in startup or configuration failures.
+
+ The following example code sets *all* environment variables related to configuring an AD/LDAP provider for external identity management. The minimum *required* variable are:
+
+ - :envvar:`MINIO_IDENTITY_LDAP_SERVER_ADDR`
+ - :envvar:`MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN`
+ - :envvar:`MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD`
+ - :envvar:`MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN`
+ - :envvar:`MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER`
+
+ .. code-block:: shell
+ :class: copyable
+
+ export MINIO_IDENTITY_LDAP_SERVER_ADDR="ldaps.example.net:636"
+ export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN="CN=xxxxx,OU=xxxxx,OU=xxxxx,DC=example,DC=net"
+ export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN="dc=example,dc=net"
+ export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER="(&(objectCategory=user)(sAMAccountName=%s))"
+ export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD="xxxxxxxxx"
+ export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER="(&(objectClass=group)(member=%d))"
+ export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN="ou=MinIO Users,dc=example,dc=net"
+ export MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY="off"
+ export MINIO_IDENTITY_LDAP_SERVER_INSECURE="off"
+ export MINIO_IDENTITY_LDAP_SERVER_STARTTLS="off"
+ export MINIO_IDENTITY_LDAP_SRV_RECORD_NAME=""
+ export MINIO_IDENTITY_LDAP_COMMENT="LDAP test server"
+
+ For complete documentation on these variables, see :ref:`minio-server-envvar-external-identity-management-ad-ldap`.
+
+#. Restart the MinIO Deployment
+
+ You must restart the MinIO deployment to apply the configuration changes.
+
+ If you configured AD/LDAP from the MinIO Console, no additional action is required.
+ The MinIO Console automatically restarts the deployment after saving the new AD/LDAP configuration.
+
+ For MinIO Client and environment variable configuration, use the :mc-cmd:`mc admin service restart` command to restart the deployment:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mc admin service restart ALIAS
+
+ Replace ``ALIAS`` with the :ref:`alias ` of the deployment to restart.
+
+#. Use the MinIO Console to Log In with AD/LDAP Credentials
+
+ The MinIO Console supports the full workflow of authenticating to the AD/LDAP provider, generating temporary credentials using the MinIO :ref:`minio-sts-assumerolewithldapidentity` Security Token Service (STS) endpoint, and logging the user into the MinIO deployment.
+
+ You can access the Console by opening the root URL for the MinIO cluster. For example, ``https://minio.example.net:9000``.
+
+ Once logged in, you can perform any action for which the authenticated user is :ref:`authorized `.
+
+ You can also create :ref:`access keys ` for supporting applications which must perform operations on MinIO.
+ Access Keys are long-lived credentials which inherit their privileges from the parent user.
+ The parent user can further restrict those privileges while creating the service account.
+
+#. Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials
+
+ MinIO requires clients to authenticate using :s3-api:`AWS Signature Version 4 protocol ` with support for the deprecated Signature Version 2 protocol.
+ Specifically, clients must present a valid access key and secret key to access any S3 or MinIO administrative API, such as ``PUT``, ``GET``, and ``DELETE`` operations.
+
+ Applications can generate temporary access credentials as-needed using the :ref:`minio-sts-assumerolewithldapidentity` Security Token Service (STS) API endpoint and AD/LDAP user credentials.
+ MinIO provides an example Go application :minio-git:`ldap.go ` that manages this workflow.
+
+ .. code-block:: shell
+
+ POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
+ &LDAPUsername=USERNAME
+ &LDAPPassword=PASSWORD
+ &Version=2011-06-15
+ &Policy={}
+
+ - Replace the ``LDAPUsername`` with the username of the AD/LDAP user.
+
+ - Replace the ``LDAPPassword`` with the password of the AD/LDAP user.
+
+ - Replace the ``Policy`` with an inline URL-encoded JSON :ref:`policy ` that further restricts the permissions associated to the temporary credentials.
+
+ Omit to use the :ref:`policy whose name matches ` the Distinguished Name (DN) of the AD/LDAP user.
+
+ The API response consists of an XML document containing the access key, secret key, session token, and expiration date.
+ Applications can use the access key and secret key to access and perform operations on MinIO.
+
+ See the :ref:`minio-sts-assumerolewithldapidentity` for reference documentation.
\ No newline at end of file
diff --git a/source/includes/baremetal/steps-configure-keycloak-identity-management.rst b/source/includes/baremetal/steps-configure-keycloak-identity-management.rst
new file mode 100644
index 000000000..0276a39c2
--- /dev/null
+++ b/source/includes/baremetal/steps-configure-keycloak-identity-management.rst
@@ -0,0 +1,78 @@
+.. |KEYCLOAK_URL| replace:: keycloak-url.example.net:8080
+.. |MINIO_S3_URL| replace:: minio-url.example.net:9000
+.. |MINIO_CONSOLE_URL| replace:: minio-url.example.net:9001
+
+#. Configure or Create a Client for Accessing Keycloak
+
+ Authenticate to the Keycloak :guilabel:`Administrative Console` and navigate to :guilabel:`Clients`.
+
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-client
+ :end-before: end-configure-keycloak-client
+
+#. Create Client Scope for MinIO Client
+
+ Client scopes allow Keycloak to map user attributes as part of the JSON Web Token (JWT) returned in authentication requests.
+ This allows MinIO to reference those attributes when assigning policies to the user.
+ This step creates the necessary client scope to support MinIO authorization after successful Keycloak authentication.
+
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-client-scope
+ :end-before: end-configure-keycloak-client-scope
+
+#. Apply the Necessary Attribute to Keycloak Users/Groups
+
+ You must assign an attribute named ``policy`` to the Keycloak Users or Groups.
+ Set the value to any :ref:`policy ` on the MinIO deployment.
+
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-user-group-attributes
+ :end-before: end-configure-keycloak-user-group-attributes
+
+#. Configure MinIO for Keycloak Authentication
+
+ MinIO supports multiple methods for configuring Keycloak authentication:
+
+ - Using a terminal/shell and the :mc:`mc idp openid` command
+ - Using environment variables set prior to starting MinIO
+
+ .. tab-set::
+
+ .. tab-item:: CLI
+
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-minio-cli
+ :end-before: end-configure-keycloak-minio-cli
+
+ .. tab-item:: Environment Variables
+
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-minio-envvar
+ :end-before: end-configure-keycloak-minio-envvar
+
+ Restart the MinIO deployment for the changes to apply.
+
+ Check the MinIO logs and verify that startup succeeded with no errors related to the OIDC configuration.
+
+ If you attempt to log in with the Console, you should now see an (SSO) button using the configured :guilabel:`Display Name`.
+
+ Specify a configured user and attempt to log in.
+ MinIO should automatically redirect you to the Keycloak login entry.
+ Upon successful authentication, Keycloak should redirect you back to the MinIO Console using either the originating Console URL *or* the :guilabel:`Redirect URI` if configured.
+
+#. Generate Application Credentials using the Security Token Service (STS)
+
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-sts
+ :end-before: end-configure-keycloak-sts
+
+#. Next Steps
+
+ Applications should implement the :ref:`STS AssumeRoleWithWebIdentity ` flow using their :ref:`SDK ` of choice.
+ When STS credentials expire, applications should have logic in place to regenerate the JWT token, STS token, and MinIO credentials before retrying and continuing operations.
+
+ Alternatively, users can generate :ref:`access keys ` through the MinIO Console for the purpose of creating long-lived API-key like access using their Keycloak credentials.
+
+
+
+
diff --git a/source/includes/baremetal/steps-configure-openid-external-identity-management.rst b/source/includes/baremetal/steps-configure-openid-external-identity-management.rst
new file mode 100644
index 000000000..6ae638ad6
--- /dev/null
+++ b/source/includes/baremetal/steps-configure-openid-external-identity-management.rst
@@ -0,0 +1,131 @@
+1. Set the OpenID Configuration Settings
+
+ You can configure the :abbr:`OIDC (OpenID Connect)` provider using either
+ environment variables *or* server runtime configuration settings. Both
+ methods require starting/restarting the MinIO deployment to apply changes. The
+ following tabs provide a quick reference of all required and optional
+ environment variables and configuration settings respectively:
+
+ .. tab-set::
+
+ .. tab-item:: Environment Variables
+
+ MinIO supports specifying the :abbr:`OIDC (OpenID Connect)` provider
+ settings using :ref:`environment variables
+ `. The
+ :mc:`minio server` process applies the specified settings on its next
+ startup. For distributed deployments, specify these settings across all
+ nodes in the deployment using the *same* values consistently.
+
+ The following example code sets *all* environment variables related to
+ configuring an :abbr:`OIDC (OpenID Connect)` provider for external
+ identity management. The minimum *required* variable is
+ :envvar:`MINIO_IDENTITY_OPENID_CONFIG_URL`:
+
+ .. code-block:: shell
+ :class: copyable
+
+ export MINIO_IDENTITY_OPENID_CONFIG_URL="https://openid-provider.example.net/.well-known/openid-configuration"
+ export MINIO_IDENTITY_OPENID_CLIENT_ID=""
+ export MINIO_IDENTITY_OPENID_CLIENT_SECRET=""
+ export MINIO_IDENTITY_OPENID_CLAIM_NAME=""
+ export MINIO_IDENTITY_OPENID_CLAIM_PREFIX=""
+ export MINIO_IDENTITY_OPENID_SCOPES=""
+ export MINIO_IDENTITY_OPENID_REDIRECT_URI=""
+ export MINIO_IDENTITY_OPENID_COMMENT=""
+
+ Replace the ``MINIO_IDENTITY_OPENID_CONFIG_URL`` with the URL endpoint of
+ the :abbr:`OIDC (OpenID Connect)` provider discovery document.
+
+ For complete documentation on these variables, see
+ :ref:`minio-server-envvar-external-identity-management-openid`
+
+ .. tab-item:: Configuration Settings
+
+ MinIO supports specifying the :abbr:`OIDC (OpenID Connect)` provider
+ settings using :mc-conf:`configuration settings `. The
+ :mc:`minio server` process applies the specified settings on its next
+ startup. For distributed deployments, the :mc:`mc admin config`
+ command applies the configuration to all nodes in the deployment.
+
+ The following example code sets *all* configuration settings related to
+ configuring an :abbr:`OIDC (OpenID Connect)` provider for external
+ identity management. The minimum *required* setting is
+ :mc-conf:`identity_openid config_url `:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mc admin config set ALIAS/ identity_openid \
+ config_url="https://openid-provider.example.net/.well-known/openid-configuration" \
+ client_id="" \
+ client_secret="" \
+ claim_name="" \
+ claim_prefix="" \
+ scopes="" \
+ redirect_uri=""
+
+ Replace the ``config_url`` with the URL endpoint of the
+ :abbr:`OIDC (OpenID Connect)` provider discovery document.
+
+ For more complete documentation on these settings, see
+ :mc-conf:`identity_openid`.
+
+#. Restart the MinIO Deployment
+
+ You must restart the MinIO deployment to apply the configuration changes.
+ Use the :mc-cmd:`mc admin service restart` command to restart the deployment.
+
+ .. code-block:: shell
+ :class: copyable
+
+ mc admin service restart ALIAS
+
+ Replace ``ALIAS`` with the :ref:`alias ` of the deployment to
+ restart.
+
+#. Generate S3-Compatible Temporary Credentials using OIDC Credentials
+
+ MinIO requires clients authenticate using :s3-api:`AWS Signature Version 4
+ protocol ` with support for the deprecated
+ Signature Version 2 protocol. Specifically, clients must present a valid access
+ key and secret key to access any S3 or MinIO administrative API, such as
+ ``PUT``, ``GET``, and ``DELETE`` operations.
+
+ Applications can generate temporary access credentials as-needed using the
+ :ref:`minio-sts-assumerolewithwebidentity` Security Token Service (STS)
+ API endpoint and the JSON Web Token (JWT) returned by the
+ :abbr:`OIDC (OpenID Connect)` provider.
+
+ The application must provide a workflow for logging into the
+ :abbr:`OIDC (OpenID Connect)` provider and retrieving the
+ JSON Web Token (JWT) associated to the authentication session. Defer to the
+ provider documentation for obtaining and parsing the JWT token after successful
+ authentication. MinIO provides an example Go application
+ :minio-git:`web-identity.go ` with
+ an example of managing this workflow.
+
+ Once the application retrieves the JWT token, use the
+ ``AssumeRoleWithWebIdentity`` endpoint to generate the temporary credentials:
+
+ .. code-block:: shell
+ :class: copyable
+
+ POST https://minio.example.net?Action=AssumeRoleWithWebIdentity
+ &WebIdentityToken=TOKEN
+ &Version=2011-06-15
+ &DurationSeconds=86400
+ &Policy=Policy
+
+ - Replace the ``TOKEN`` with the JWT token returned in the previous step.
+ - Replace the ``DurationSeconds`` with the duration in seconds until the temporary credentials expire. The example above specifies a period of ``86400`` seconds, or 24 hours.
+ - Replace the ``Policy`` with an inline URL-encoded JSON :ref:`policy ` that further restricts the permissions associated to the temporary credentials.
+
+ Omit to use the policy associated to the OpenID user :ref:`policy claim `.
+
+ The API response consists of an XML document containing the
+ access key, secret key, session token, and expiration date. Applications
+ can use the access key and secret key to access and perform operations on
+ MinIO.
+
+ See the :ref:`minio-sts-assumerolewithwebidentity` for reference documentation.
\ No newline at end of file
diff --git a/source/includes/common-installation.rst b/source/includes/common-installation.rst
index 385afdd0b..47eb32008 100644
--- a/source/includes/common-installation.rst
+++ b/source/includes/common-installation.rst
@@ -3,7 +3,7 @@
The following tabs provide examples of installing MinIO onto 64-bit Linux operating systems using RPM, DEB, or binary.
The RPM and DEB packages automatically install MinIO to the necessary system paths and create a ``minio`` service for ``systemctl``.
MinIO strongly recommends using the RPM or DEB installation routes.
-To update deployments managed using ``systemctl``, see :ref:`minio-upgrade-systemctl`.
+To update deployments managed using ``systemctl``, see :ref:`minio-upgrade`.
.. tab-set::
diff --git a/source/includes/common-minio-external-auth.rst b/source/includes/common-minio-external-auth.rst
index ee355948b..a38f0a97e 100644
--- a/source/includes/common-minio-external-auth.rst
+++ b/source/includes/common-minio-external-auth.rst
@@ -422,6 +422,7 @@ Specify a comma-separated list of MinIO :ref:`policies ` to assign
.. start-minio-identity-management-role-id
Specify a unique ID MinIO uses to generate an ARN for this identity manager.
+MinIO automatically adds an ``idmp-`` prefix to the specified ID when generating the ARN.
If omitted, MinIO automatically generates the ID and prints the full ARN to the server log.
diff --git a/source/includes/common/common-configure-keycloak-identity-management.rst b/source/includes/common/common-configure-keycloak-identity-management.rst
index 7207ebcfb..79e2ff455 100644
--- a/source/includes/common/common-configure-keycloak-identity-management.rst
+++ b/source/includes/common/common-configure-keycloak-identity-management.rst
@@ -322,7 +322,7 @@ The following example code sets the minimum required environment variables relat
:class: copyable
:substitutions:
- MINIO_IDENTITY_OPENID_CONFIG_URL_PRIMARY_IAM="https://|KEYCLOAK_URL|/.well-known/openid-configuration"
+ MINIO_IDENTITY_OPENID_CONFIG_URL_PRIMARY_IAM="https://|KEYCLOAK_URL|/realms/REALM/.well-known/openid-configuration"
MINIO_IDENTITY_OPENID_CLIENT_ID_PRIMARY_IAM="MINIO_CLIENT"
MINIO_IDENTITY_OPENID_CLIENT_SECRET_PRIMARY_IAM="MINIO_CLIENT_SECRET"
MINIO_IDENTITY_OPENID_DISPLAY_NAME_PRIMARY_IAM="SSO_IDENTIFIER"
diff --git a/source/includes/common/common-k8s-connect-operator-console-no-plugin.rst b/source/includes/common/common-k8s-connect-operator-console-no-plugin.rst
deleted file mode 100644
index 64c2bff9a..000000000
--- a/source/includes/common/common-k8s-connect-operator-console-no-plugin.rst
+++ /dev/null
@@ -1,35 +0,0 @@
-The Operator Console service does not automatically bind or expose itself for external access on the Kubernetes cluster.
-Instead, you must configure a network control plane component, such as a load balancer or ingress, to grant external access.
-
-For testing purposes or short-term access, expose the Operator Console service through a NodePort using the following patch:
-
-.. code-block:: shell
- :class: copyable
-
- kubectl patch service -n minio-operator console -p '
- {
- "spec": {
- "ports": [
- {
- "name": "http",
- "port": 9090,
- "protocol": "TCP",
- "targetPort": 9090,
- "nodePort": 30090
- },
- {
- "name": "https",
- "port": 9443,
- "protocol": "TCP",
- "targetPort": 9443,
- "nodePort": 30433
- }
- ],
- "type": "NodePort"
- }
- }'
-
-After applying the path, you can access the service through port ``30433`` on any of the Kubernetes worker nodes.
-
-Append the ``nodePort`` value to the externally-accessible IP address of a worker node in your Kubernetes cluster.
-Use the appropriate ``http`` or ``https`` port depending on whether you deployed Operator Console with TLS.
diff --git a/source/includes/common/common-k8s-connect-operator-console.rst b/source/includes/common/common-k8s-connect-operator-console.rst
deleted file mode 100644
index b8c50dca2..000000000
--- a/source/includes/common/common-k8s-connect-operator-console.rst
+++ /dev/null
@@ -1,60 +0,0 @@
-.. dropdown:: Port Forwarding
- :open:
-
- The :ref:`Operator Console service ` does not automatically bind or expose itself for external access on the Kubernetes cluster.
- Instead, configure a network control plane component, such as a load balancer or ingress, to grant external access.
-
- .. cond:: k8s and not openshift
-
- For testing purposes or short-term access, expose the Operator Console service through a NodePort using the following patch:
-
- .. code-block:: shell
- :class: copyable
-
- kubectl patch service -n minio-operator console -p '
- {
- "spec": {
- "ports": [
- {
- "name": "http",
- "port": 9090,
- "protocol": "TCP",
- "targetPort": 9090,
- "nodePort": 30090
- },
- {
- "name": "https",
- "port": 9443,
- "protocol": "TCP",
- "targetPort": 9443,
- "nodePort": 30433
- }
- ],
- "type": "NodePort"
- }
- }'
-
- The patch command should output ``service/console patched``.
- You can now access the service through ports ``30433`` (HTTPS) or ``30090`` (HTTP) on any of your Kubernetes worker nodes.
-
- For example, a Kubernetes cluster with the following Operator nodes might be accessed at ``https://172.18.0.2:30443``:
-
- .. code-block:: shell
-
- kubectl get nodes -o custom-columns=IP:.status.addresses[:]
- IP
- map[address:172.18.0.5 type:InternalIP],map[address:k3d-MINIO-agent-3 type:Hostname]
- map[address:172.18.0.6 type:InternalIP],map[address:k3d-MINIO-agent-2 type:Hostname]
- map[address:172.18.0.2 type:InternalIP],map[address:k3d-MINIO-server-0 type:Hostname]
- map[address:172.18.0.4 type:InternalIP],map[address:k3d-MINIO-agent-1 type:Hostname]
- map[address:172.18.0.3 type:InternalIP],map[address:k3d-MINIO-agent-0 type:Hostname]
-
- Use the following command to retrieve the JWT token necessary for logging into the Operator Console:
-
- .. code-block:: shell
- :class: copyable
-
- kubectl get secret/console-sa-secret -n minio-operator -o json | jq -r '.data.token' | base64 -d
-
- If your local host does not have the ``jq`` utility installed, you can run the ``kubectl`` part of this command (before ``| jq``) and locate the ``data.token`` section of the output.
-
diff --git a/source/includes/common/installation.rst b/source/includes/common/installation.rst
deleted file mode 100644
index 815448d67..000000000
--- a/source/includes/common/installation.rst
+++ /dev/null
@@ -1,147 +0,0 @@
-.. _minio-installation:
-
-========================
-Install and Deploy MinIO
-========================
-
-.. default-domain:: minio
-
-.. contents:: Table of Contents
- :local:
- :depth: 1
-
-.. meta::
- :description: MinIO Deployment Topologies and Installation Instructions
- :keywords: MinIO, Deploy, Architecture, Topology, Distributed, Replication, Install
-
-.. container:: extlinks-video
-
- - `Installing and Running MinIO on Linux `__
-
- - `Object Storage Essentials `__
-
- - `How to Connect to MinIO with JavaScript `__
-
-MinIO is a software-defined high performance distributed object storage server.
-You can run MinIO on consumer or enterprise-grade hardware and a variety
-of operating systems and architectures.
-
-All MinIO deployments implement :ref:`Erasure Coding ` backends.
-You can deploy MinIO using one of the following topologies:
-
-.. _minio-installation-comparison:
-
-:ref:`Single-Node Single-Drive ` (SNSD or "Standalone")
- Local development and evaluation with no/limited reliability
-
-:ref:`Single-Node Multi-Drive ` (SNMD or "Standalone Multi-Drive")
- Workloads with lower performance, scale, and capacity requirements
-
- Drive-level reliability with configurable tolerance for loss of up to 1/2 all drives
-
- Evaluation of multi-drive topologies and failover behavior.
-
-:ref:`Multi-Node Multi-Drive ` (MNMD or "Distributed")
- Enterprise-grade high-performance object storage
-
- Multi Node/Drive level reliability with configurable tolerance for loss of up to 1/2 all nodes/drives
-
- Primary storage for AI/ML, Distributed Query, Analytics, and other Data Lake components
-
- Scalable for Petabyte+ workloads - both storage capacity and performance
-
-.. cond:: macos or windows
-
- .. note::
-
- Use |platform|-based MinIO deployments for early development and evaluation.
- MinIO provides no guarantee of support for :abbr:`SNMD (Single-Node Multi-Drive)` or :abbr:`MNMD (Multi-Node Multi-Drive)` topologies on |platform|.
-
- MinIO strongly recommends :minio-docs:`Linux (RHEL, Ubuntu) ` or :minio-docs:`Kubernetes (Upstream, OpenShift) ` for long-term development and production environments.
-
-Site Replication
-----------------
-
-Site replication expands the features of bucket replication to include IAM, security tokens, access keys, and bucket features the same across all sites.
-
-:ref:`Site replication ` links multiple MinIO deployments together and keeps the buckets, objects, and Identity and Access Management (IAM) settings in sync across all connected sites.
-
-.. include:: /includes/common-replication.rst
- :start-after: start-mc-admin-replicate-what-replicates
- :end-before: end-mc-admin-replicate-what-replicates
-
-.. cond:: macos or windows
-
- MinIO does not recommend using |platform| hosts for site replication outside of early development, evaluation, or general experimentation.
- For production, use :minio-docs:`Linux ` or :minio-docs:`Kubernetes `.
-
-What Does Not Replicate?
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-Not everything replicates across sites.
-
-.. include:: /includes/common-replication.rst
- :start-after: start-mc-admin-replicate-what-does-not-replicate
- :end-before: end-mc-admin-replicate-what-does-not-replicate
-
-.. _minio-installation-platform-support:
-
-Platform Support
-----------------
-
-.. cond:: linux
-
- MinIO provides builds of the MinIO server (:mc:`minio`) and the
- MinIO :abbr:`CLI (Command Line Interface)` (:mc:`mc`) for the following
- platforms.
-
- - Red Hat Enterprise Linux 8.5+ (including all binary-compatible RHEL alternatives)
- - Ubuntu 18.04+
-
- MinIO provides builds for the following architectures:
-
- - AMD64
- - ARM64
- - PowerPC 64 LE
- - S390X
-
-.. cond:: macos
-
- MinIO recommends non-EOL macOS versions (10.14+).
-
-For unlisted platforms or architectures, please reach out to MinIO at
-hello@min.io for additional support and guidance. You can build MinIO from
-:minio-git:`source ` and
-`cross-compile
-`__
-for your platform and architecture combo. MinIO generally does not recommend
-source-based installations in production environments.
-
-.. cond:: linux
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- /operations/install-deploy-manage/deploy-minio-single-node-single-drive
- /operations/install-deploy-manage/deploy-minio-single-node-multi-drive
- /operations/install-deploy-manage/deploy-minio-multi-node-multi-drive
- /operations/install-deploy-manage/multi-site-replication
-
-.. cond:: windows
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- /operations/install-deploy-manage/deploy-minio-single-node-single-drive
-
-.. cond:: macos
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- /operations/install-deploy-manage/deploy-minio-single-node-single-drive
- /operations/install-deploy-manage/deploy-minio-single-node-multi-drive
- /operations/install-deploy-manage/multi-site-replication
\ No newline at end of file
diff --git a/source/includes/container/installation.rst b/source/includes/container/installation.rst
deleted file mode 100644
index 1af9050ae..000000000
--- a/source/includes/container/installation.rst
+++ /dev/null
@@ -1,96 +0,0 @@
-.. _minio-installation:
-
-========================
-Install and Deploy MinIO
-========================
-
-.. default-domain:: minio
-
-.. contents:: Table of Contents
- :local:
- :depth: 1
-
-.. container:: extlinks-video
-
- - `Installing and Running MinIO: Overview `__
- - `Installing and Running MinIO: Installation Lab `__
- - `Installing and Running MinIO: Docker Compose Overview `__
- - `Installing and Running MinIO: Docker Compose Lab: `__
-
-MinIO is a software-defined high performance distributed object storage server.
-You can run MinIO on consumer or enterprise-grade hardware and a variety of operating systems and architectures.
-
-MinIO supports three deployment topologies:
-
-Single-Node Single-Drive (SNSD or "Standalone")
- A single MinIO server with a single storage volume or folder.
- |SNSD| deployment provides failover protections. Drive-level reliability and failover depends on the underlying storage volume.
-
- |SNSD| deployments are best suited for evaluation and initial development of applications using MinIO for object storage.
-
- |SNSD| deployments implement a zero-parity erasure coding backend and include support for the following erasure-coding dependent features:
-
- - :ref:`Versioning `
- - :ref:`Object Locking / Retention `
-
-Single-Node Multi-Drive (SNMD or "Standalone Multi-Drive")
- A single MinIO server with four or more storage volumes.
- |SNMD| deployments provide drive-level reliability and failover only.
-
-Multi-Node Multi-Drive (MNMD or "Distributed")
- Multiple MinIO servers with at least four drives across all servers.
- The distributed |MNMD| topology supports production-grade object storage with drive and node-level availability and resiliency.
-
-.. note::
-
- This documentation provides instructions for |SNSD| and |SNMD| for supporting local development and evaluation of MinIO on a single host machine **only**.
- For |MNMD| deployments, use the MinIO Kubernetes Operator to :minio-docs:`deploy and manage MinIO tenants in a containerized and orchestrated environment `.
-
-Site Replication
-----------------
-
-:ref:`Site replication ` links multiple MinIO deployments together and keeps the buckets, objects, and Identity and Access Management (IAM) settings in sync across all connected sites.
-
-.. include:: /includes/common-replication.rst
- :start-after: start-mc-admin-replicate-what-replicates
- :end-before: end-mc-admin-replicate-what-replicates
-
-.. important::
-
- MinIO does not recommend using |platform| hosts for site replication outside of early development, evaluation, or general experimentation.
- For production, use :minio-docs:`Kubernetes ` for an orchestrated container environment.
-
-What Does Not Replicate?
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-Not everything replicates across sites.
-
-.. include:: /includes/common-replication.rst
- :start-after: start-mc-admin-replicate-what-does-not-replicate
- :end-before: end-mc-admin-replicate-what-does-not-replicate
-
-.. _minio-installation-platform-support:
-
-Platform Support
-----------------
-
-MinIO provides container images at the following repositories:
-
-- https://hub.docker.com/r/minio/minio
-- https://quay.io/repository/minio/minio?tab=info
-
-.. versionchanged:: RELEASE.2022-12-02T19-19-22Z
-
- These images include the :ref:`MinIO Client ` command line tool built in for container-level debugging.
- However, to regularly interact with a container MinIO install, :ref:`install the MinIO Client ` on your computer and define an :mc:`alias ` to the container instead.
-
-Use of MinIO images from any other repository, host, or organization is at your own risk.
-
-The :ref:`Single-Node Single-Drive ` and :ref:`Single-Node Multi-Drive ` tutorials provide instructions for the `Docker `__ and :podman-docs:`Podman <>` container managers.
-
-.. toctree::
- :titlesonly:
- :hidden:
-
- /operations/install-deploy-manage/deploy-minio-single-node-single-drive
- /operations/install-deploy-manage/deploy-minio-single-node-multi-drive
diff --git a/source/includes/container/steps-upgrade-minio-deployment.rst b/source/includes/container/steps-upgrade-minio-deployment.rst
deleted file mode 100644
index 9d09e4a4a..000000000
--- a/source/includes/container/steps-upgrade-minio-deployment.rst
+++ /dev/null
@@ -1,142 +0,0 @@
-MinIO uses an update-then-restart methodology for upgrading a deployment to a newer release:
-
-1. Update the container MinIO image with the newer release.
-2. Restart the container.
-
-This procedure does not require taking downtime and is non-disruptive to ongoing operations.
-
-Considerations
---------------
-
-Upgrades Are Non-Disruptive
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-MinIO's upgrade-then-restart procedure does *not* require taking downtime or scheduling a maintenance period.
-MinIO restarts are fast, such that restarting all server processes in parallel typically completes in a few seconds.
-MinIO operations are atomic and strictly consistent, such that applications using MinIO or S3 SDKs can rely on the built-in :aws-docs:`transparent retry ` without further client-side logic.
-This ensures upgrades are non-disruptive to ongoing operations.
-
-Check Release Notes
-~~~~~~~~~~~~~~~~~~~
-
-MinIO publishes :minio-git:`Release Notes ` for your reference as part of identifying the changes applied in each release.
-Review the associated release notes between your current MinIO version and the newer release so you have a complete view of any changes.
-
-Pay particular attention to any releases that are *not* backwards compatible.
-You cannot trivially downgrade from any such release.
-
-Procedure
----------
-
-You can run the ``podman container inspect`` or ``docker inspect`` command to inspect the container and validate the current container image:
-
-.. code-block:: shell
- :class: copyable
-
- # For docker, use docker inspect
- podman container inspect --format='{{.Config.Image}}' CONTAINER_NAME
-
-The following output indicates the container was created using the most recent stable image tag:
-
-.. code-block:: shell
-
- quay.io/minio/minio:latest
-
-Use the :ref:`minio-upgrade-latest-tag` steps to upgrade your container.
-
-The following output indicates the container was created using a specific image tag:
-
-.. code-block:: shell
-
- quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z
-
-Use the :ref:`minio-upgrade-specific-tag` steps to upgrade your container.
-
-.. _minio-upgrade-latest-tag:
-
-Upgrade Containers using Latest Image Tag
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-1. Update your image registry
-
- Pull the latest stable MinIO image for the configured image repository:
-
- .. code-block:: shell
- :class: copyable
-
- # For docker, use docker pull
- podman pull quay.io/minio/minio:latest
-
-#. Restart the container
-
- You must restart the container to load the new image binary for use by MinIO:
-
- .. code-block:: shell
- :class: copyable
-
- # For docker, use docker restart
- podman container restart CONTAINER_NAME
-
-#. Validate the Upgrade
-
- Use the :mc:`mc admin info` command to check that the MinIO container is online, operational, and reflects the installed MinIO version.
-
-#. Update MinIO Client
-
- You should upgrade your :mc:`mc` binary to match or closely follow the MinIO server release.
- You can use the :mc:`mc update` command to update the binary to the latest stable release:
-
- .. code-block:: shell
- :class: copyable
-
- mc update
-
-.. _minio-upgrade-specific-tag:
-
-Upgrade Containers using Specific Image Tag
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-1. Update your local image registry
-
- Pull the desired image you want to use for updating the container.
- The following example uses the latest stable version of MinIO:
-
- .. code-block:: shell
- :class: copyable
- :substitutions:
-
- # For docker, use docker pull
- podman pull quay.io/minio/minio:|minio-tag|
-
-#. Modify the container start script or configuration
-
- Specify the new MinIO tag to the container start script or configuration.
- For Docker, this might be the Compose file used to start MinIO.
- For Podman, this might be a YAML file used to create the container or pod.
-
- Ensure the ``image: `` matches the newly pulled image tag.
-
-#. Restart or re-create the container
-
- If you started the container using CLI commands, you may need to completely stop, remove, and re-create the container.
- Use a script to perform this procedure to minimize potential downtime.
-
- For Docker, this might require running ``docker compose restart``.
-
-#. Validate the Upgrade
-
- Use the :mc:`mc admin info` command to check that the MinIO container is online, operational, and reflects the installed MinIO version.
-
-#. Update MinIO Client
-
- You should upgrade your :mc:`mc` binary to match or closely follow the MinIO server release.
- You can use the :mc:`mc update` command to update the binary to the latest stable release:
-
- .. code-block:: shell
- :class: copyable
-
- mc update
-
-
-
-
diff --git a/source/includes/eks/deploy-minio-on-elastic-kubernetes-service.rst b/source/includes/eks/deploy-minio-on-elastic-kubernetes-service.rst
deleted file mode 100644
index 0fbefc5d9..000000000
--- a/source/includes/eks/deploy-minio-on-elastic-kubernetes-service.rst
+++ /dev/null
@@ -1,58 +0,0 @@
-.. _deploy-operator-eks:
-
-==========================================================
-Deploy MinIO Operator on Amazon Elastic Kubernetes Service
-==========================================================
-
-.. default-domain:: minio
-
-.. contents:: Table of Contents
- :local:
- :depth: 1
-
-Overview
---------
-
-:eks-docs:`Amazon® Elastic Kubernetes Service® ` (EKS) is an enterprise-ready Kubernetes container platform with full-stack automated operations to manage hybrid cloud, multi-cloud, and edge deployments.
-The MinIO Kubernetes Operator supports deploying MinIO Tenants onto EKS infrastructure using the MinIO Operator Console or by using `kustomize `__ for :minio-git:`YAML-defined deployments `.
-
-MinIO supports the following methods for installing the MinIO Operator onto your :abbr:`EKS (Elastic Kubernetes Service)` clusters:
-
-:minio-web:`Through the AWS Marketplace `
- MinIO maintains an `AWS Marketplace listing `__ through which you can register your EKS cluster with |subnet|.
- Any tenant you deploy through Marketplace-connected clusters can take advantage of SUBNET registration, including 24/7 direct access to MinIO engineers.
-
-This page documents deploying the MinIO Operator through the CLI using Kustomize.
-For instructions on deploying the MinIO Operator through the AWS Marketplace, see :minio-web:`Deploy MinIO through EKS `
-
-This documentation assumes familiarity with all referenced Kubernetes and Elastic Kubernetes Service concepts, utilities, and procedures.
-While this documentation *may* provide guidance for configuring or deploying Kubernetes-related or Elastic Kubernetes Service-related resources on a best-effort basis, it is not a replacement for the official :kube-docs:`Kubernetes Documentation <>`.
-
-Prerequisites
--------------
-
-Existing EKS Cluster
-~~~~~~~~~~~~~~~~~~~~
-
-This procedure assumes an existing :abbr:`EKS (Elastic Kubernetes Service)` cluster onto which you can deploy the MinIO Operator.
-
-The Operator by default deploys pods and services with two replicas each and pod anti-affinity.
-The GKE cluster should therefore have at least two nodes available for scheduling Operator pods and services.
-While these nodes *may* be the same nodes intended for use by MinIO Tenants, co-locating Operator and Tenant pods may increase the risk of service interruptions due to the loss of any one node.
-
-``kubectl`` Access to the EKS Cluster
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Ensure your host machine has a ``kubectl`` installation compatible with the target EKS cluster.
-For guidance on connecting ``kubectl`` to EKS, see :aws-docs:`Creating or updating a kubeconfig file for an Amazon EKS cluster `.
-
-Your ``kubectl`` configuration must include authentication as a user with the correct permissions.
-MinIO provides an example IAM policy for Marketplace-based installations in the MinIO Operator :minio-git:`github repository `.
-You can use this policy as a baseline for manual Operator installations.
-
-Procedure
----------
-
-The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
-
-.. include:: /includes/common/common-install-operator-kustomize.rst
diff --git a/source/includes/gke/deploy-minio-on-google-kubernetes-engine.rst b/source/includes/gke/deploy-minio-on-google-kubernetes-engine.rst
deleted file mode 100644
index 2a0ecd2d9..000000000
--- a/source/includes/gke/deploy-minio-on-google-kubernetes-engine.rst
+++ /dev/null
@@ -1,56 +0,0 @@
-.. _deploy-operator-gke:
-
-=================================================
-Deploy MinIO Operator on Google Kubernetes Engine
-=================================================
-
-.. default-domain:: minio
-
-.. contents:: Table of Contents
- :local:
- :depth: 1
-
-Overview
---------
-
-`Google Kubernetes Engine `__ (GKE) offers a highly automated secure and fully managed Kubernetes platform.
-The MinIO Kubernetes Operator supports deploying MinIO Tenants onto GKE infrastructure using the MinIO Operator Console or `kustomize `__ for :minio-git:`YAML-defined deployments `.
-
-:minio-web:`Through the GKE Marketplace `
- MinIO maintains an `GKE Marketplace listing `__ through which you can register your GKE cluster with |subnet|.
- Any MinIO tenant you deploy through Marketplace-connected clusters can take advantage of SUBNET registration, including 24/7 direct access to MinIO engineers.
-
-Using the MinIO ``kubectl`` Plugin
- MinIO provides a ``kubectl`` plugin for installing and managing the MinIO Operator and Tenants through a terminal or shell (CLI) environment.
- You can manually register these tenants with |subnet| at any time.
-
-This page documents deploying the MinIO Operator through the CLI using Kustomize.
-For instructions on deploying the MinIO Operator through the GKE Marketplace, see :minio-web:`Deploy MinIO through GKE `
-
-This documentation assumes familiarity with all referenced Kubernetes and Google Kubernetes Engine concepts, utilities, and procedures.
-While this documentation *may* provide guidance for configuring or deploying Kubernetes-related or Google Kubernetes Engine-related resources on a best-effort basis, it is not a replacement for the official :kube-docs:`Kubernetes Documentation <>`.
-
-Prerequisites
--------------
-
-Existing GKE Cluster
-~~~~~~~~~~~~~~~~~~~~
-
-This procedure assumes an existing :abbr:`GKE (Google Kubernetes Engine)` cluster onto which you can deploy the MinIO Operator.
-
-The Operator by default deploys pods and services with two replicas each and pod anti-affinity.
-The GKE cluster should therefore have at least two nodes available for scheduling Operator pods and services.
-While these nodes *may* be the same nodes intended for use by MinIO Tenants, co-locating Operator and Tenant pods may increase the risk of service interruptions due to the loss of any one node.
-
-``kubectl`` Access to the GKE Cluster
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Ensure your host machine has a ``kubectl`` installation compatible with the target GKE cluster.
-For guidance on connecting ``kubectl`` to GKE, see :gke-docs:`Install kubectl and configure cluster access `.
-
-Procedure
----------
-
-The following steps deploy Operator using Kustomize and a ``kustomization.yaml`` file from the MinIO Operator GitHub repository.
-
-.. include:: /includes/common/common-install-operator-kustomize.rst
diff --git a/source/includes/k8s/file-transfer-protocol-k8s.rst b/source/includes/k8s/file-transfer-protocol-k8s.rst
index 6096eebc5..f4010cb28 100644
--- a/source/includes/k8s/file-transfer-protocol-k8s.rst
+++ b/source/includes/k8s/file-transfer-protocol-k8s.rst
@@ -1,119 +1,51 @@
-.. versionadded:: Operator v5.0.7
-
-Overview
---------
-
-Starting with Operator 5.0.7 and :minio-release:`MinIO Server RELEASE.2023-04-20T17-56-55Z `, you can use the SSH File Transfer Protocol (SFTP) to interact with the objects on a MinIO Operator Tenant deployment.
-
-SFTP is defined by the Internet Engineering Task Force (IETF) as an extension of SSH 2.0.
-It allows file transfer over SSH for use with :ref:`Transport Layer Security (TLS) ` and virtual private network (VPN) applications.
-
-Enabling SFTP does not affect other MinIO features.
-
-
-Supported Commands
-~~~~~~~~~~~~~~~~~~
-
-When enabled, MinIO supports the following SFTP operations:
-
-- ``get``
-- ``put``
-- ``ls``
-- ``mkdir``
-- ``rmdir``
-- ``delete``
-
-MinIO does not support either ``append`` or ``rename`` operations.
-
-MinIO Operator only supports the SFTP file transfer protocol.
-Other protocols, such as FTP, are not supported for accessing Tenants.
-
-
-Considerations
---------------
-
-
-Versioning
-~~~~~~~~~~
-
-SFTP clients can only operate on the :ref:`latest version ` of an object.
-Specifically:
-
-- For read operations, MinIO only returns the latest version of the requested object(s) to the SFTP client.
-- For write operations, MinIO applies normal versioning behavior and creates a new object version at the specified namespace.
- ``rm`` and ``rmdir`` operations create ``DeleteMarker`` objects.
-
-
-Authentication and Access
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-SFTP access requires the same authentication as any other S3 client.
-MinIO supports the following authentication providers:
-
-- :ref:`MinIO IDP ` users and their service accounts
-- :ref:`Active Directory/LDAP ` users and their service accounts
-- :ref:`OpenID/OIDC ` service accounts
-- :ref:`Certificate Key File `
-
-:ref:`STS ` credentials **cannot** access buckets or objects over SFTP.
-
-Authenticated users can access buckets and objects based on the :ref:`policies ` assigned to the user or parent user account.
-
-The SFTP protocol does not require any of the ``admin:*`` :ref:`permissions `.
-You may not perform other MinIO admin actions with SFTP.
-
+#. Enable SFTP for the desired Tenant:
-Prerequisites
--------------
+ Use the following Kubectl command to edit the Tenant YAML configuration:
-- MinIO Operator v5.0.7 or later.
-- Enable an SFTP port (8022) for the server.
-- A port to use for the SFTP commands and a range of ports to allow the SFTP server to request to use for the data transfer.
+ .. code-block:: yaml
+ kubectl edit tenants/my-tenant -n my-tenant-ns
-Procedure
----------
+ Replace ``my-tenant`` and ``my-tenant-ns`` with the desired Tenant and namespace.
-#. Enable SFTP for the desired Tenant:
+ In the ``features:`` section, set the value of ``enableSFTP`` to ``true``:
- .. tab-set::
+ .. code-block:: yaml
- .. tab-item:: Operator Console
+ spec:
+ configuration:
+ name: my-tenant-env-configuration
+ credsSecret:
+ name: my-tenant-secret
+ exposeServices:
+ console: true
+ minio: true
+ features:
+ enableSFTP: true
- - In the Operator Console, click on the Tenant for which to enable SFTP.
- - In the :guilabel:`Configuration` tab, toggle :guilabel:`SFTP` to :guilabel:`Enabled`.
- - Click :guilabel:`Save`.
- - Click :guilabel:`Restart` to restart MinIO and apply your changes.
+ Kubectl restarts MinIO to apply the change.
- .. tab-item:: Kubectl
-
- Use the following Kubectl command to edit the Tenant YAML configuration:
+ You may also set ``enableSFTP`` in your `Helm chart `__ or `Kustomize configuration `__ to enable SFTP for newly created Tenants.
+
- .. code-block:: yaml
+#. If needed, configure ingress for the SFTP port according to your local policies.
- kubectl edit tenants/my-tenant -n my-tenant-ns
+#. Validate the configuration
- Replace ``my-tenant`` and ``my-tenant-ns`` with the desired Tenant and namespace.
+ The following ``kubectl get`` command uses `yq `__ to display the value of ``enableSFTP``, indicating whether SFTP is enabled:
- In the ``features:`` section, set the value of ``enableSFTP`` to ``true``:
+ .. code-block:: console
+ :class: copyable
- .. code-block:: yaml
+ kubectl get tenants/my-tenant -n my-tenant-ns -o yaml | yq '.spec.features'
- spec:
- configuration:
- name: my-tenant-env-configuration
- exposeServices:
- console: true
- minio: true
- features:
- enableSFTP: true
+ Replace ``my-tenant`` and ``my-tenant-ns`` with the desired Tenant and namespace.
- Kubectl restarts MinIO to apply the change.
+ If SFTP is enabled, the output resembles the following:
- You may also set ``enableSFTP`` in your `Helm chart `__ or `Kustomize configuration `__ to enable SFTP for newly created Tenants.
-
+ .. code-block:: console
-#. If needed, configure ingress for the SFTP port according to your local policies.
+ enableSFTP: true
#. Use your preferred SFTP client to connect to the MinIO deployment.
You must connect as a user whose :ref:`policies ` allow access to the desired buckets and objects.
@@ -121,33 +53,15 @@ Procedure
The specifics of connecting to the MinIO deployment depend on your SFTP client.
Refer to the documentation for your client.
+ The following example connects to the MinIO Tenant SFTP server forwarded to the local host system, and lists the contents of a bucket named ``runner``.
-Examples
---------
-
-The following examples use the `SFTP CLI client `__ on a Linux system.
+ .. code-block:: console
-Connect to MinIO Using SFTP
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The following example connects to an SFTP server, lists the contents of a bucket named ``test-bucket``, and downloads an object.
-
-.. code-block:: console
-
- sftp -P 8022 my-access-key@localhost
- my-access-key@localhost's password:
- Connected to localhost.
- sftp> ls
- test-bucket
- sftp> ls test-bucket
- test-bucket/test-file.txt
- sftp> get test-bucket/test-file.txt
- Fetching /test-bucket/test-file.txt to test-file.txt
- test-file.txt 100% 6 1.3KB/s 00:00
-
-
-Check if SFTP is Enabled for a Tenant
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ > sftp -P 8022 minio@localhost
+ minio@localhost's password:
+ Connected to localhost.
+ sftp> ls runner/
+ chunkdocs testdir
The following ``kubectl get`` command uses `yq `__ to display the value of ``enableSFTP``, indicating whether SFTP is enabled:
@@ -164,73 +78,3 @@ If SFTP is enabled, the output resembles the following:
enableSFTP: true
-.. _minio-certificate-key-file-sftp-k8s:
-
-Connect to MinIO Using SFTP with a Certificate Key File
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. versionadded:: RELEASE.2024-05-07T06-41-25Z
-
-
-MinIO supports mutual TLS (mTLS) certificate-based authentication on SFTP, where both the server and the client verify the authenticity of each other.
-
-This type of authentication requires the following:
-
-1. Public key file for the trusted certificate authority
-2. Public key file for the MinIO Server minted and signed by the trusted certificate authority
-3. Public key file for the user minted and signed by the trusted certificate authority for the client connecting by SFTP and located in the user's ``.ssh`` folder (or equivalent for the operating system)
-
-The keys must include a `principals list `__ of the user(s) that can authenticate with the key:
-
-.. code-block:: console
- :class: copyable
-
- ssh-keygen -s ~/.ssh/ca_user_key -I miniouser -n miniouser -V +1h -z 1 miniouser1.pub
-
-- ``-s`` specifies the path to the certificate authority public key to use for generating this key.
- The specified public key must have a ``principals`` list that includes this user.
-- ``-I`` specifies the key identity for the public key.
-- ``-n`` creates the ``user principals`` list for which this key is valid.
- You must include the user for which this key is valid, and the user must match the username in MinIO.
-- ``-V`` limits the duration for which the generated key is valid.
- In this example, the key is valid for one hour.
- Adjust the duration for your requirements.
-- ``-z`` adds a serial number to the key to distinguish this generated public key from other keys signed by the same certificate authority public key.
-
-MinIO requires specifying the Certificate Authority used to sign the certificates for SFTP access.
-Start or restart the MinIO Server and specify the path to the trusted certificate authority's public key using an ``--sftp="trusted-user-ca-key=PATH"`` flag:
-
- .. code-block:: console
- :class: copyable
-
- minio server {path-to-server} --sftp="trusted-user-ca-key=/path/to/.ssh/ca_user_key.pub" {...other flags}
-
-When connecting to the MinIO Server with SFTP, the client verifies the MinIO Server's certificate.
-The client then passes its own certificate to the MinIO Server.
-The MinIO Server verifies the key created above by comparing its value to the the known public key from the certificate authority provided at server startup.
-
-Once the MinIO Server verifies the client's certificate, the user can connect to the MinIO server over SFTP:
-
-.. code-block:: bash
- :class: copyable:
-
- sftp -P
-
-Require service account or LDAP for authentication
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To force authentication to SFTP using LDAP or service account credentials, append a suffix to the username.
-Valid suffixes are either ``=ldap`` or ``=svc``.
-
-.. code-block:: console
-
- > sftp -P 8022 my-ldap-user=ldap@[minio@localhost]:/bucket
-
-
-.. code-block:: console
-
- > sftp -P 8022 my-ldap-user=svc@[minio@localhost]:/bucket
-
-
-- Replace ``my-ldap-user`` with the username to use.
-- Replace ``[minio@localhost]`` with the address of the MinIO server.
\ No newline at end of file
diff --git a/source/includes/k8s/steps-configure-ad-ldap-external-identity-management.rst b/source/includes/k8s/steps-configure-ad-ldap-external-identity-management.rst
index 7e6ca901d..0b1cf7ebc 100644
--- a/source/includes/k8s/steps-configure-ad-ldap-external-identity-management.rst
+++ b/source/includes/k8s/steps-configure-ad-ldap-external-identity-management.rst
@@ -1,109 +1,102 @@
-Deploy MinIO Tenant with Active Directory / LDAP Identity Management
---------------------------------------------------------------------
+#. Access the Operator Console
-1) Access the Operator Console
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
+ For instructions, see :ref:`Configure access to the Operator Console service `.
-Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
-For instructions, see :ref:`Configure access to the Operator Console service `.
+ Open your browser to the temporary URL and enter the JWT Token into the login page.
+ You should see the :guilabel:`Tenants` page:
-Open your browser to the temporary URL and enter the JWT Token into the login page.
-You should see the :guilabel:`Tenants` page:
+ .. image:: /images/k8s/operator-dashboard.png
+ :align: center
+ :width: 70%
+ :class: no-scaled-link
+ :alt: MinIO Operator Console
-.. image:: /images/k8s/operator-dashboard.png
- :align: center
- :width: 70%
- :class: no-scaled-link
- :alt: MinIO Operator Console
+ To deploy a new MinIO Tenant with AD/LDAP external identity management, select the :guilabel:`+ Create Tenant` button.
-Click the :guilabel:`+ Create Tenant` to start creating a MinIO Tenant.
+ To configure an existing MinIO Tenant with AD/LDAP external identity management select that Tenant from the displayed list.
+ The following steps reference the necessary sections and configuration settings for existing Tenants.
-If you are modifying an existing Tenant, select that Tenant from the list.
-The following steps reference the necessary sections and configuration settings for existing Tenants.
+#. Complete the :guilabel:`Identity Provider` Section
-2) Complete the :guilabel:`Identity Provider` Section
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ To enable external identity management with an Active Directory / LDAP provider, select the :guilabel:`Identity Provider` section.
+ You can then change the radio button to :guilabel:`Active Directory` to display the configuration settings.
-To enable external identity management with an Active Directory / LDAP provider, select the :guilabel:`Identity Provider` section.
-You can then change the radio button to :guilabel:`Active Directory` to display the configuration settings.
+ .. image:: /images/k8s/operator-create-tenant-identity-provider-adldap.png
+ :align: center
+ :width: 70%
+ :class: no-scaled-link
+ :alt: MinIO Operator Console - Create a Tenant - External Identity Provider Section - Active Directory / LDAP
-.. image:: /images/k8s/operator-create-tenant-identity-provider-adldap.png
- :align: center
- :width: 70%
- :class: no-scaled-link
- :alt: MinIO Operator Console - Create a Tenant - External Identity Provider Section - Active Directory / LDAP
+ An asterisk ``*`` marks required fields.
+ The following table provides general guidance for those fields:
-An asterisk ``*`` marks required fields.
-The following table provides general guidance for those fields:
+ .. list-table::
+ :header-rows: 1
+ :widths: 40 60
+ :width: 100%
-.. list-table::
- :header-rows: 1
- :widths: 40 60
- :width: 100%
+ * - Field
+ - Description
- * - Field
- - Description
+ * - LDAP Server Address
+ - The hostname of the Active Directory or LDAP server.
- * - LDAP Server Address
- - The hostname of the Active Directory or LDAP server.
+ * - Lookup Bind DN
+ - The Distinguished Name MinIO uses to authenticate and query the AD/LDAP server.
- * - Lookup Bind DN
- - The Distinguished Name MinIO uses to authenticate and query the AD/LDAP server.
+ See :ref:`minio-external-identity-management-ad-ldap-lookup-bind` for more information.
- See :ref:`minio-external-identity-management-ad-ldap-lookup-bind` for more information.
+ * - List of user DNs (Distinguished Names) to be Tenant Administrators
+ - Specify a user :abbr:`DNs (Distinguished Names)` which MinIO assigns a :ref:`policy ` with administrative permissions for the Tenant.
+ You can specify multiple :abbr:`DNs (Distinguished Names)` by selecting the plus :octicon:`plus-circle` icon.
+ You can delete a DN by selecting the trash can :octicon:`trash` icon for that DN.
- * - List of user DNs (Distinguished Names) to be Tenant Administrators
- - Specify a user :abbr:`DNs (Distinguished Names)` which MinIO assigns a :ref:`policy ` with administrative permissions for the Tenant.
- You can specify multiple :abbr:`DNs (Distinguished Names)` by selecting the plus :octicon:`plus-circle` icon.
- You can delete a DN by selecting the trash can :octicon:`trash` icon for that DN.
+ Once you complete the section, you can finish any other required sections of :ref:`Tenant Deployment `.
-Once you complete the section, you can finish any other required sections of :ref:`Tenant Deployment `.
+#. Assign Policies to AD/LDAP Users
-3) Assign Policies to AD/LDAP Users
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ MinIO by default assigns no :ref:`policies ` to AD/LDAP users or groups.
+ You must explicitly assign MinIO policies to a given user or group Distinguished Name (DN) to grant that user or group access to the MinIO deployment.
-MinIO by default assigns no :ref:`policies ` to AD/LDAP users or groups.
-You must explicitly assign MinIO policies to a given user or group Distinguished Name (DN) to grant that user or group access to the MinIO deployment.
+ The following example assumes an existing :ref:`alias ` configured for the MinIO Tenant.
-The following example assumes an existing :ref:`alias ` configured for the MinIO Tenant.
+ Use the :mc:`mc idp ldap policy attach` command to assign a user or group DN to an existing MinIO Policy:
-Use the :mc:`mc idp ldap policy attach` command to assign a user or group DN to an existing MinIO Policy:
+ .. code-block:: shell
+ :class: copyable
-.. code-block:: shell
- :class: copyable
+ mc idp ldap policy attach minio-tenant POLICY --user='uid=primary,cn=applications,dc=domain,dc=com'
+ mc idp ldap policy attach minio-tenant POLICY --group='cn=applications,ou=groups,dc=domain,dc=com'
- mc idp ldap policy attach minio-tenant POLICY --user='uid=primary,cn=applications,dc=domain,dc=com'
- mc idp ldap policy attach minio-tenant POLICY --group='cn=applications,ou=groups,dc=domain,dc=com'
+ Replace ``POLICY`` with the name of the MinIO policy to assign to the user or group DN.
-Replace ``POLICY`` with the name of the MinIO policy to assign to the user or group DN.
+ See :ref:`minio-external-identity-management-ad-ldap-access-control` for more information on access control with AD/LDAP users and groups.
-See :ref:`minio-external-identity-management-ad-ldap-access-control` for more information on access control with AD/LDAP users and groups.
+#. Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials
-4) Generate S3-Compatible Temporary Credentials using AD/LDAP Credentials
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Applications can use an AD/LDAP user credential to generate temporary S3-compatible credentials as-needed using the :ref:`minio-sts-assumerolewithldapidentity` Security Token Service (STS) API endpoint.
+ MinIO provides an example Go application :minio-git:`ldap.go ` with an example of managing this workflow.
-Applications can use an AD/LDAP user credential to generate temporary S3-compatible credentials as-needed using the :ref:`minio-sts-assumerolewithldapidentity` Security Token Service (STS) API endpoint.
-MinIO provides an example Go application :minio-git:`ldap.go ` with an example of managing this workflow.
+ .. code-block:: shell
-.. code-block:: shell
+ POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
+ &LDAPUsername=USERNAME
+ &LDAPPassword=PASSWORD
+ &Version=2011-06-15
+ &Policy={}
- POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
- &LDAPUsername=USERNAME
- &LDAPPassword=PASSWORD
- &Version=2011-06-15
- &Policy={}
+ - Replace ``minio.example.net`` with the hostname or URL for the MinIO Tenant service.
-- Replace ``minio.example.net`` with the hostname or URL for the MinIO Tenant service.
+ - Replace the ``LDAPUsername`` with the username of the AD/LDAP user.
-- Replace the ``LDAPUsername`` with the username of the AD/LDAP user.
+ - Replace the ``LDAPPassword`` with the password of the AD/LDAP user.
-- Replace the ``LDAPPassword`` with the password of the AD/LDAP user.
+ - Replace the ``Policy`` with an inline URL-encoded JSON :ref:`policy ` that further restricts the permissions associated to the temporary credentials.
-- Replace the ``Policy`` with an inline URL-encoded JSON :ref:`policy ` that further restricts the permissions associated to the temporary credentials.
+ Omit to use the :ref:`policy whose name matches ` the Distinguished Name (DN) of the AD/LDAP user.
- Omit to use the :ref:`policy whose name matches ` the Distinguished Name (DN) of the AD/LDAP user.
+ The API response consists of an XML document containing the access key, secret key, session token, and expiration date.
+ Applications can use the access key and secret key to access and perform operations on MinIO.
-The API response consists of an XML document containing the access key, secret key, session token, and expiration date.
-Applications can use the access key and secret key to access and perform operations on MinIO.
-
-See the :ref:`minio-sts-assumerolewithldapidentity` for reference documentation.
+ See the :ref:`minio-sts-assumerolewithldapidentity` for reference documentation.
diff --git a/source/includes/k8s/steps-configure-keycloak-identity-management.rst b/source/includes/k8s/steps-configure-keycloak-identity-management.rst
index 94e3f8d9a..229c667e2 100644
--- a/source/includes/k8s/steps-configure-keycloak-identity-management.rst
+++ b/source/includes/k8s/steps-configure-keycloak-identity-management.rst
@@ -2,38 +2,34 @@
.. |MINIO_S3_URL| replace:: minio.minio-tenant.svc.cluster-domain.example
.. |MINIO_CONSOLE_URL| replace:: minio-console.minio-tenant.svc.cluster-domain.example
-1) Configure or Create a Client for Accessing Keycloak
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Configure or Create a Client for Accessing Keycloak
-Authenticate to the Keycloak :guilabel:`Administrative Console` and navigate to :guilabel:`Clients`.
+ Authenticate to the Keycloak :guilabel:`Administrative Console` and navigate to :guilabel:`Clients`.
-.. include:: /includes/common/common-configure-keycloak-identity-management.rst
- :start-after: start-configure-keycloak-client
- :end-before: end-configure-keycloak-client
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-client
+ :end-before: end-configure-keycloak-client
-2) Create Client Scope for MinIO Client
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Create Client Scope for MinIO Client
-Client scopes allow Keycloak to map user attributes as part of the JSON Web Token (JWT) returned in authentication requests.
-This allows MinIO to reference those attributes when assigning policies to the user.
-This step creates the necessary client scope to support MinIO authorization after successful Keycloak authentication.
+ Client scopes allow Keycloak to map user attributes as part of the JSON Web Token (JWT) returned in authentication requests.
+ This allows MinIO to reference those attributes when assigning policies to the user.
+ This step creates the necessary client scope to support MinIO authorization after successful Keycloak authentication.
-.. include:: /includes/common/common-configure-keycloak-identity-management.rst
- :start-after: start-configure-keycloak-client-scope
- :end-before: end-configure-keycloak-client-scope
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-client-scope
+ :end-before: end-configure-keycloak-client-scope
-3) Apply the Necessary Attribute to Keycloak Users/Groups
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Apply the Necessary Attribute to Keycloak Users/Groups
-You must assign an attribute named ``policy`` to the Keycloak Users or Groups.
-Set the value to any :ref:`policy ` on the MinIO deployment.
+ You must assign an attribute named ``policy`` to the Keycloak Users or Groups.
+ Set the value to any :ref:`policy ` on the MinIO deployment.
-.. include:: /includes/common/common-configure-keycloak-identity-management.rst
- :start-after: start-configure-keycloak-user-group-attributes
- :end-before: end-configure-keycloak-user-group-attributes
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-user-group-attributes
+ :end-before: end-configure-keycloak-user-group-attributes
-4) Configure MinIO for Keycloak Authentication
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Configure MinIO for Keycloak Authentication
.. include:: /includes/common/common-configure-keycloak-identity-management.rst
:start-after: start-configure-keycloak-minio-cli
@@ -44,16 +40,14 @@ Restart the MinIO deployment for the changes to apply.
Check the MinIO logs and verify that startup succeeded with no errors related to the OIDC configuration.
-5) Generate Application Credentials using the Security Token Service (STS)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Generate Application Credentials using the Security Token Service (STS)
+ .. include:: /includes/common/common-configure-keycloak-identity-management.rst
+ :start-after: start-configure-keycloak-sts
+ :end-before: end-configure-keycloak-sts
-.. include:: /includes/common/common-configure-keycloak-identity-management.rst
- :start-after: start-configure-keycloak-sts
- :end-before: end-configure-keycloak-sts
+#. Next Steps
-Next Steps
-~~~~~~~~~~
Applications should implement the :ref:`STS AssumeRoleWithWebIdentity ` flow using their :ref:`SDK ` of choice.
When STS credentials expire, applications should have logic in place to regenerate the JWT token, STS token, and MinIO credentials before retrying and continuing operations.
diff --git a/source/includes/k8s/steps-configure-minio-kes-hashicorp.rst b/source/includes/k8s/steps-configure-minio-kes-hashicorp.rst
index e1f94c989..f105fe96f 100644
--- a/source/includes/k8s/steps-configure-minio-kes-hashicorp.rst
+++ b/source/includes/k8s/steps-configure-minio-kes-hashicorp.rst
@@ -1,53 +1,41 @@
-Deploy MinIO Tenant with Server-Side Encryption
------------------------------------------------
+#. Review the Tenant CRD
-1) Access the Operator Console
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Review the :ref:`Tenant CRD ` ``TenantSpec.kes`` object, the ``TenantSpec.configuration`` object, and the :minio-docs:`KES Configuration reference`.
-Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
-For instructions, see :ref:`Configure access to the Operator Console service `.
+ You must prepare all necessary configurations associated to your external Key Management Service of choice before proceeding.
-Open your browser to the temporary URL and enter the JWT Token into the login page.
-You should see the :guilabel:`Tenants` page:
+#. Create or Modify your Tenant YAML to set the values of ``KesConfig`` as necessary:
-.. image:: /images/k8s/operator-dashboard.png
- :align: center
- :width: 70%
- :class: no-scaled-link
- :alt: MinIO Operator Console
+ You must modify your Tenant YAML or ``Kustomize`` templates to reflect the necessary KES configuration.
+ The following example is taken from the :minio-git:`MinIO Operator Kustomize examples `
-Click the :guilabel:`+ Create Tenant` to start creating a MinIO Tenant.
+ .. code-block:: yaml
-2) Complete the :guilabel:`Encryption` Section
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ kes:
+ image: "" # minio/kes:2024-06-17T15-47-05Z
+ env: [ ]
+ replicas: 2
+ kesSecret:
+ name: kes-configuration
+ imagePullPolicy: "IfNotPresent"
-Reference the :ref:`Deploy a MinIO Tenant ` procedure for complete documentation of other Tenant settings.
+ The ``kes-configuration`` secret must reference a Kubernetes Opaque Secret which contains a ``stringData`` object with the full KES configuration as ``server-config.yaml``.
+ The ``keystore`` field must contain the full configuration associated with your preferred Key Management System.
-To enable |SSE| with a :kes-docs:`supported KMS target <#supported-kms-targets>` during Tenant deployment, select the :guilabel:`Encryption` section and toggle the switch to :guilabel:`Enabled`.
-You can then select the Radio button for the chosen KMS provider to display configuration settings for that provider.
+ Reference :minio-git:`the Kustomize example ` for additional guidance.
-.. image:: /images/k8s/operator-create-tenant-encryption.png
- :align: center
- :width: 70%
- :class: no-scaled-link
- :alt: MinIO Operator Console - Create a Tenant - Encryption Section
+#. Create or Modify your Tenant YAML to set the values of ``TenantSpec.configuration`` as necessary.
-An asterisk ``*`` marks required fields.
+ TODO
-Refer to the Configuration References section of the tutorial for your chosen :kes-docs:`supported KMS target <#supported-kms-targets>` for more information on the configuration options for your KMS.
+#. Generate a New Encryption Key
-Once you have completed the configuration, you can finish any remaining sections of :ref:`Tenant Deployment `.
+ .. include:: /includes/k8s/common-minio-kes.rst
+ :start-after: start-kes-generate-key-desc
+ :end-before: end-kes-generate-key-desc
-3) Generate a New Encryption Key
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Enable SSE-KMS for a Bucket
-.. include:: /includes/k8s/common-minio-kes.rst
- :start-after: start-kes-generate-key-desc
- :end-before: end-kes-generate-key-desc
-
-4) Enable SSE-KMS for a Bucket
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/k8s/common-minio-kes.rst
- :start-after: start-kes-enable-sse-kms-desc
- :end-before: end-kes-enable-sse-kms-desc
+ .. include:: /includes/k8s/common-minio-kes.rst
+ :start-after: start-kes-enable-sse-kms-desc
+ :end-before: end-kes-enable-sse-kms-desc
diff --git a/source/includes/k8s/steps-configure-openid-external-identity-management.rst b/source/includes/k8s/steps-configure-openid-external-identity-management.rst
index 6bdfe0ea4..bb930ab24 100644
--- a/source/includes/k8s/steps-configure-openid-external-identity-management.rst
+++ b/source/includes/k8s/steps-configure-openid-external-identity-management.rst
@@ -1,131 +1,124 @@
-Deploy MinIO Tenant with OpenID Connect Identity Management
------------------------------------------------------------
+1. Access the Operator Console
-1) Access the Operator Console
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
+ For instructions, see :ref:`Configure access to the Operator Console service `.
-Temporarily forward traffic between the local host machine and the MinIO Operator Console and retrieve the JWT token for your Operator deployment.
-For instructions, see :ref:`Configure access to the Operator Console service `.
+ Open your browser to the temporary URL and enter the JWT Token into the login page.
+ You should see the :guilabel:`Tenants` page:
-Open your browser to the temporary URL and enter the JWT Token into the login page.
-You should see the :guilabel:`Tenants` page:
+ .. image:: /images/k8s/operator-dashboard.png
+ :align: center
+ :width: 70%
+ :class: no-scaled-link
+ :alt: MinIO Operator Console
-.. image:: /images/k8s/operator-dashboard.png
- :align: center
- :width: 70%
- :class: no-scaled-link
- :alt: MinIO Operator Console
+ To deploy a new MinIO Tenant with OIDC external identity management, select the :guilabel:`+ Create Tenant` button.
-Click the :guilabel:`+ Create Tenant` to start creating a MinIO Tenant.
+ TO configure an existing MinIO Tenant with OIDC external identity management select that Tenant from the displayed list.
+ The following steps reference the necessary sections and configuration settings for existing Tenants.
-If you are modifying an existing Tenant, select that Tenant from the list.
-The following steps reference the necessary sections and configuration settings for existing Tenants.
+#. Complete the :guilabel:`Identity Provider` Section
-2) Complete the :guilabel:`Identity Provider` Section
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ To enable external identity management with an OIDC select the :guilabel:`Identity Provider` section.
+ You can then change the radio button to :guilabel:`OIDC` to display the configuration settings.
-To enable external identity management with an OIDC select the :guilabel:`Identity Provider` section.
-You can then change the radio button to :guilabel:`OIDC` to display the configuration settings.
+ .. image:: /images/k8s/operator-create-tenant-identity-provider-openid.png
+ :align: center
+ :width: 70%
+ :class: no-scaled-link
+ :alt: MinIO Operator Console - Create a Tenant - External Identity Provider Section - OpenID
-.. image:: /images/k8s/operator-create-tenant-identity-provider-openid.png
- :align: center
- :width: 70%
- :class: no-scaled-link
- :alt: MinIO Operator Console - Create a Tenant - External Identity Provider Section - OpenID
+ An asterisk ``*`` marks required fields.
+ The following table provides general guidance for those fields:
-An asterisk ``*`` marks required fields.
-The following table provides general guidance for those fields:
+ .. list-table::
+ :header-rows: 1
+ :widths: 40 60
+ :width: 100%
-.. list-table::
- :header-rows: 1
- :widths: 40 60
- :width: 100%
+ * - Field
+ - Description
- * - Field
- - Description
+ * - Configuration URL
+ - The hostname of the OpenID ``.well-known/openid-configuration`` file.
- * - Configuration URL
- - The hostname of the OpenID ``.well-known/openid-configuration`` file.
+ * - | Client ID
+ | Secret ID
+ - The Client and Secret ID MinIO uses when authenticating OIDC user credentials against OIDC service.
- * - | Client ID
- | Secret ID
- - The Client and Secret ID MinIO uses when authenticating OIDC user credentials against OIDC service.
+ * - Claim Name
+ - The OIDC Claim MinIO uses for identifying the :ref:`policies ` to attach to the authenticated user.
- * - Claim Name
- - The OIDC Claim MinIO uses for identifying the :ref:`policies ` to attach to the authenticated user.
+ Once you complete the section, you can finish any other required sections of :ref:`Tenant Deployment `.
-Once you complete the section, you can finish any other required sections of :ref:`Tenant Deployment `.
+#. Assign Policies to OIDC Users
-3) Assign Policies to OIDC Users
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ MinIO by default assigns no :ref:`policies ` to OIDC users.
+ MinIO uses the specified user Claim to identify one or more policies to attach to the authenticated user.
+ If the Claim is empty or specifies policies which do not exist on the deployment, the authenticated user has no permissions on the Tenant.
-MinIO by default assigns no :ref:`policies ` to OIDC users.
-MinIO uses the specified user Claim to identify one or more policies to attach to the authenticated user.
-If the Claim is empty or specifies policies which do not exist on the deployment, the authenticated user has no permissions on the Tenant.
+ The following example assumes an existing :ref:`alias ` configured for the MinIO Tenant.
-The following example assumes an existing :ref:`alias ` configured for the MinIO Tenant.
+ Consider the following example policy that grants general S3 API access on only the ``data`` bucket:
-Consider the following example policy that grants general S3 API access on only the ``data`` bucket:
+ .. code-block:: json
+ :class: copyable
-.. code-block:: json
- :class: copyable
+ {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "s3:*"
+ ],
+ "Resource": [
+ "arn:aws:s3:::data",
+ "arn:aws:s3:::data/*"
+ ]
+ }
+ ]
+ }
- {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Effect": "Allow",
- "Action": [
- "s3:*"
- ],
- "Resource": [
- "arn:aws:s3:::data",
- "arn:aws:s3:::data/*"
- ]
- }
- ]
- }
+ Use the :mc:`mc admin policy create` command to create a policy for use by an OIDC user:
-Use the :mc:`mc admin policy create` command to create a policy for use by an OIDC user:
+ .. code-block:: shell
+ :class: copyable
-.. code-block:: shell
- :class: copyable
+ mc admin policy create minio-tenant datareadonly /path/to/datareadonly.json
- mc admin policy create minio-tenant datareadonly /path/to/datareadonly.json
+ MinIO attaches the ``datareadonly`` policy to any authenticated OIDC user with ``datareadonly`` included in the configured claim.
-MinIO attaches the ``datareadonly`` policy to any authenticated OIDC user with ``datareadonly`` included in the configured claim.
+ See :ref:`minio-external-identity-management-openid-access-control` for more information on access control with OIDC users and groups.
-See :ref:`minio-external-identity-management-openid-access-control` for more information on access control with OIDC users and groups.
+#. Generate S3-Compatible Temporary Credentials using OIDC Credentials
-4) Generate S3-Compatible Temporary Credentials using OIDC Credentials
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Applications can generate temporary access credentials as-needed using the :ref:`minio-sts-assumerolewithwebidentity` Security Token Service (STS) API endpoint and the JSON Web Token (JWT) returned by the :abbr:`OIDC (OpenID Connect)` provider.
-Applications can generate temporary access credentials as-needed using the :ref:`minio-sts-assumerolewithwebidentity` Security Token Service (STS) API endpoint and the JSON Web Token (JWT) returned by the :abbr:`OIDC (OpenID Connect)` provider.
+ The application must provide a workflow for logging into the :abbr:`OIDC (OpenID Connect)` provider and retrieving the JSON Web Token (JWT) associated to the authentication session.
+ Defer to the provider documentation for obtaining and parsing the JWT token after successful authentication.
+ MinIO provides an example Go application :minio-git:`web-identity.go ` with an example of managing this workflow.
-The application must provide a workflow for logging into the :abbr:`OIDC (OpenID Connect)` provider and retrieving the JSON Web Token (JWT) associated to the authentication session.
-Defer to the provider documentation for obtaining and parsing the JWT token after successful authentication.
-MinIO provides an example Go application :minio-git:`web-identity.go ` with an example of managing this workflow.
+ Once the application retrieves the JWT token, use the ``AssumeRoleWithWebIdentity`` endpoint to generate the temporary credentials:
-Once the application retrieves the JWT token, use the ``AssumeRoleWithWebIdentity`` endpoint to generate the temporary credentials:
+ .. code-block:: shell
+ :class: copyable
-.. code-block:: shell
- :class: copyable
+ POST https://minio.example.net?Action=AssumeRoleWithWebIdentity
+ &WebIdentityToken=TOKEN
+ &Version=2011-06-15
+ &DurationSeconds=86400
+ &Policy=Policy
- POST https://minio.example.net?Action=AssumeRoleWithWebIdentity
- &WebIdentityToken=TOKEN
- &Version=2011-06-15
- &DurationSeconds=86400
- &Policy=Policy
+ - Replace ``minio.example.net`` with the hostname or URL of the MinIO Tenant service.
+ - Replace the ``TOKEN`` with the JWT token returned in the previous step.
+ - Replace the ``DurationSeconds`` with the duration in seconds until the temporary credentials expire. The example above specifies a period of ``86400`` seconds, or 24 hours.
+ - Replace the ``Policy`` with an inline URL-encoded JSON :ref:`policy ` that further restricts the permissions associated to the temporary credentials.
-- Replace ``minio.example.net`` with the hostname or URL of the MinIO Tenant service.
-- Replace the ``TOKEN`` with the JWT token returned in the previous step.
-- Replace the ``DurationSeconds`` with the duration in seconds until the temporary credentials expire. The example above specifies a period of ``86400`` seconds, or 24 hours.
-- Replace the ``Policy`` with an inline URL-encoded JSON :ref:`policy ` that further restricts the permissions associated to the temporary credentials.
+ Omit to use the policy associated to the OpenID user :ref:`policy claim `.
- Omit to use the policy associated to the OpenID user :ref:`policy claim `.
+ The API response consists of an XML document containing the access key, secret key, session token, and expiration date.
+ Applications can use the access key and secret key to access and perform operations on MinIO.
-The API response consists of an XML document containing the access key, secret key, session token, and expiration date.
-Applications can use the access key and secret key to access and perform operations on MinIO.
-
-See the :ref:`minio-sts-assumerolewithwebidentity` for reference documentation.
+ See the :ref:`minio-sts-assumerolewithwebidentity` for reference documentation.
diff --git a/source/includes/linux/file-transfer-protocol-not-k8s.rst b/source/includes/linux/file-transfer-protocol-not-k8s.rst
index 7661be1ea..ae165aff5 100644
--- a/source/includes/linux/file-transfer-protocol-not-k8s.rst
+++ b/source/includes/linux/file-transfer-protocol-not-k8s.rst
@@ -1,123 +1,49 @@
-.. versionadded:: MinIO RELEASE.2023-04-20T17-56-55Z
-
-Overview
---------
-
-Starting with :minio-release:`MinIO Server RELEASE.2023-04-20T17-56-55Z `, you can use the File Transfer Protocol (FTP) or SSH File Transfer Protocol (SFTP) to interact with the objects on a MinIO deployment.
-
-You must specifically enable FTP or SFTP when starting the server.
-Enabling either server type does not affect other MinIO features.
-
-This page uses the abbreviation FTP throughout, but you can use any of the supported FTP protocols described below.
-
-Supported Protocols
-~~~~~~~~~~~~~~~~~~~
-
-When enabled, MinIO supports FTP access over the following protocols:
-
-- SSH File Transfer Protocol (SFTP)
-
- SFTP is defined by the Internet Engineering Task Force (IETF) as an extension of SSH 2.0.
- SFTP allows file transfer over SSH for use with :ref:`Transport Layer Security (TLS) ` and virtual private network (VPN) applications.
-
- Your FTP client must support SFTP.
-
-- File Transfer Protocol over SSL/TLS (FTPS)
-
- FTPS allows for encrypted FTP communication with TLS certificates over the standard FTP communication channel.
- FTPS should not be confused with SFTP, as FTPS does not communicate over a Secure Shell (SSH).
-
- Your FTP client must support FTPS.
-
-- File Transfer Protocol (FTP)
-
- Unencrypted file transfer.
-
- MinIO does **not** recommend using unencrypted FTP for file transfer.
-
-.. admonition:: MinIO Operator Tenants only support SFTP
- :class: note
-
- MinIO Tenants deployed with Operator only support SFTP.
- For details, see `File Transfer Protocol for Tenants `__.
-
-
-Supported Commands
-~~~~~~~~~~~~~~~~~~
-
-When enabled, MinIO supports the following FTP operations:
-
-- ``get``
-- ``put``
-- ``ls``
-- ``mkdir``
-- ``rmdir``
-- ``delete``
-
-MinIO does not support either ``append`` or ``rename`` operations.
-
-Considerations
---------------
-
-Versioning
-~~~~~~~~~~
-
-SFTP clients can only operate on the :ref:`latest version ` of an object.
-Specifically:
-
-- For read operations, MinIO only returns the latest version of the requested object(s) to the FTP client.
-- For write operations, MinIO applies normal versioning behavior and creates a new object version at the specified namespace.
- ``delete`` and ``rmdir`` operations create ``DeleteMarker`` objects.
-
-
-Authentication and Access
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-FTP access requires the same authentication as any other S3 client.
-MinIO supports the following authentication providers:
+1. Start MinIO with an FTP and/or SFTP port enabled.
-- :ref:`MinIO IDP ` users and their service accounts
-- :ref:`Active Directory/LDAP ` users and their service accounts
-- :ref:`OpenID/OIDC ` service accounts
+ .. tab-set::
-:ref:`STS ` credentials **cannot** access buckets or objects over FTP.
+ .. tab-item:: FTPS
+ :sync: ftps
-Authenticated users can access buckets and objects based on the :ref:`policies ` assigned to the user or parent user account.
+ The following example starts MinIO with FTPS enabled.
-The FTP protocol does not require any of the ``admin:*`` :ref:`permissions `.
-The FTP protocols do not support any of the MinIO admin actions.
+ .. code-block:: shell
+ :class: copyable
-Prerequisites
--------------
+ minio server http://server{1...4}/disk{1...4} \
+ --ftp="address=:8021" \
+ --ftp="passive-port-range=30000-40000" \
+ --ftp="tls-private-key=path/to/private.key" \
+ --ftp="tls-public-cert=path/to/public.crt" \
+ ...
-- MinIO RELEASE.2023-04-20T17-56-55Z or later.
-- Enable an FTP or SFTP port for the server.
-- A port to use for the FTP commands and a range of ports to allow the FTP server to request to use for the data transfer.
+ .. note::
-Procedure
----------
+ Omit ``tls-private-key`` and ``tls-public-cert`` to use the MinIO default TLS keys for FTPS.
+ For more information, see the :ref:`TLS on MinIO documentation `.
-1. Start MinIO with an FTP and/or SFTP port enabled.
+ .. tab-item:: SFTP/FTP
+ :sync: sftp
- .. code-block:: shell
- :class: copyable
+ .. code-block:: shell
+ :class: copyable
- minio server http://server{1...4}/disk{1...4} \
- --ftp="address=:8021" \
- --ftp="passive-port-range=30000-40000" \
- --sftp="address=:8022" \
- --sftp="ssh-private-key=/home/miniouser/.ssh/id_rsa" \
- ...
+ minio server http://server{1...4}/disk{1...4} \
+ --ftp="address=:8021" \
+ --ftp="passive-port-range=30000-40000" \
+ --sftp="address=:8022" \
+ --sftp="ssh-private-key=/home/miniouser/.ssh/id_rsa" \
+ ...
- See the :mc-cmd:`minio server --ftp` and :mc-cmd:`minio server --sftp` for details on using these flags to start the MinIO service.
- To connect to the an FTP port with TLS (FTPS), pass the ``tls-private-key`` and ``tls-public-cert`` keys and values, as well, unless using the MinIO default TLS keys.
+ See the :mc-cmd:`minio server --ftp` and :mc-cmd:`minio server --sftp` for details on using these flags to start the MinIO service.
+ To connect to the an FTP port with TLS (FTPS), pass the ``tls-private-key`` and ``tls-public-cert`` keys and values, as well, unless using the MinIO default TLS keys.
- The output of the command should return a response that resembles the following:
+ The output of the command should return a response that resembles the following:
- .. code-block:: shell
+ .. code-block:: shell
- MinIO FTP Server listening on :8021
- MinIO SFTP Server listening on :8022
+ MinIO FTP Server listening on :8021
+ MinIO SFTP Server listening on :8022
2. Use your preferred FTP client to connect to the MinIO deployment.
You must connect as a user whose :ref:`policies ` allow access to the desired buckets and objects.
@@ -127,213 +53,97 @@ Procedure
To connect over TLS or through SSH, you must use a client that supports the desired protocol.
-Examples
---------
-
-The following examples use the `FTP CLI client `__ on a Linux system.
-
-
-Connect to MinIO Using FTP
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The following example connects to a server using ``minio`` credentials to list contents in a bucket named ``runner``
-
-.. code-block:: shell
-
- > ftp localhost -P 8021
- Connected to localhost.
- 220 Welcome to MinIO FTP Server
- Name (localhost:user): minio
- 331 User name ok, password required
- Password:
- 230 Password ok, continue
- Remote system type is UNIX.
- Using binary mode to transfer files.
- ftp> ls runner/
- 229 Entering Extended Passive Mode (|||39155|)
- 150 Opening ASCII mode data connection for file list
- drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 chunkdocs/
- drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 testdir/
- ...
-
-Start MinIO with FTP over TLS (FTPS) Enabled
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The following example starts MinIO with FTPS enabled.
-
-.. code-block:: shell
- :class: copyable
-
- minio server http://server{1...4}/disk{1...4} \
- --ftp="address=:8021" \
- --ftp="passive-port-range=30000-40000" \
- --ftp="tls-private-key=path/to/private.key" \
- --ftp="tls-public-cert=path/to/public.crt" \
- ...
-
-.. note::
-
- Omit ``tls-private-key`` and ``tls-public-cert`` to use the MinIO default TLS keys for FTPS.
- For more information, see the :ref:`TLS on MinIO documentation `.
-
-Download an Object over FTP
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This example lists items in a bucket, then downloads the contents of the bucket.
-
-.. code-block:: console
-
- > ftp localhost -P 8021
- Connected to localhost.
- 220 Welcome to MinIO FTP Server
- Name (localhost:user): minio
- 331 User name ok, password required
- Password:
- 230 Password ok, continue
- Remote system type is UNIX.
- Using binary mode to transfer files.ftp> ls runner/chunkdocs/metadata
- 229 Entering Extended Passive Mode (|||44269|)
- 150 Opening ASCII mode data connection for file list
- -rwxrwxrwx 1 nobody nobody 45 Apr 1 06:13 chunkdocs/metadata
- 226 Closing data connection, sent 75 bytes
- ftp> get
- (remote-file) runner/chunkdocs/metadata
- (local-file) test
- local: test remote: runner/chunkdocs/metadata
- 229 Entering Extended Passive Mode (|||37785|)
- 150 Data transfer starting 45 bytes
- 45 3.58 KiB/s
- 226 Closing data connection, sent 45 bytes
- 45 bytes received in 00:00 (3.55 KiB/s)
- ...
-
-Connect to MinIO Using SFTP
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The following example connects to an SFTP server, lists the contents of a bucket named ``runner``, and downloads an object.
-
-.. code-block:: console
-
- > sftp -P 8022 minio@localhost
- minio@localhost's password:
- Connected to localhost.
- sftp> ls runner/
- chunkdocs testdir
- sftp> get runner/chunkdocs/metadata metadata
- Fetching /runner/chunkdocs/metadata to metadata
- metadata 100% 226 16.6KB/s 00:00
-
-Connect to MinIO Using SFTP with a Certificate Key File
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. versionadded:: RELEASE.2024-05-07T06-41-25Z
-
-
-MinIO supports mutual TLS (mTLS) certificate-based authentication on SFTP, where both the server and the client verify the authenticity of each other.
-
-This type of authentication requires the following:
-
-1. Public key file for the trusted certificate authority
-2. Public key file for the MinIO Server minted and signed by the trusted certificate authority
-3. Public key file for the user minted and signed by the trusted certificate authority for the client connecting by SFTP and located in the user's ``.ssh`` folder (or equivalent for the operating system)
-
-The keys must include a `principals list `__ of the user(s) that can authenticate with the key:
-
-.. code-block:: console
- :class: copyable
-
- ssh-keygen -s ~/.ssh/ca_user_key -I miniouser -n miniouser -V +1h -z 1 miniouser1.pub
-
-- ``-s`` specifies the path to the certificate authority public key to use for generating this key.
- The specified public key must have a ``principals`` list that includes this user.
-- ``-I`` specifies the key identity for the public key.
-- ``-n`` creates the ``user principals`` list for which this key is valid.
- You must include the user for which this key is valid, and the user must match the username in MinIO.
-- ``-V`` limits the duration for which the generated key is valid.
- In this example, the key is valid for one hour.
- Adjust the duration for your requirements.
-- ``-z`` adds a serial number to the key to distinguish this generated public key from other keys signed by the same certificate authority public key.
-
-MinIO requires specifying the Certificate Authority used to sign the certificates for SFTP access.
-Start or restart the MinIO Server and specify the path to the trusted certificate authority's public key using an ``--sftp="trusted-user-ca-key=PATH"`` flag:
-
- .. code-block:: console
- :class: copyable
-
- minio server {path-to-server} --sftp="trusted-user-ca-key=/path/to/.ssh/ca_user_key.pub" {...other flags}
-
-When connecting to the MinIO Server with SFTP, the client verifies the MinIO Server's certificate.
-The client then passes its own certificate to the MinIO Server.
-The MinIO Server verifies the key created above by comparing its value to the the known public key from the certificate authority provided at server startup.
-
-Once the MinIO Server verifies the client's certificate, the user can connect to the MinIO server over SFTP:
-
-.. code-block:: bash
- :class: copyable:
-
- sftp -P
-
-
-Procedure
-+++++++++
-
-The following procedure generates two key-value pairs, signs one with the other, then uses the resulting signed key to log in to the SFTP server.
-
-1. Generate a key-value pair for the MinIO Server
-
- .. code-block:: bash
- :class: copyable
-
- ssh-keygen -f ./ca_user_key
-
-2. Generate a key-value pair for the user
-
- .. code-block:: bash
- :class: copyable
+3. Connect to MinIO
- ssh-keygen -f ./minioadmin
+ .. tab-set::
- Replace ``minioadmin`` with the user accessing the MinIO Server by SFTP.
+ .. tab-item:: SFTP/FTP
+ :sync: sftp
-3. Sign the user key-value pair key with the MinIO Server key-value pair key
- .. code-block:: bash
- :class: copyable
+ The following example connects to an SFTP server, and lists the contents of a bucket named ``runner``.
- ssh-keygen -s ca_user_key -I minioadmin -n minioadmin -V +30d -z 1 minioadmin.pub
+ .. code-block:: console
- Move the ``minioadmin.pub`` key to the same directory as ``minioadmin`` key-value pair, such as ``~/.ssh/meaningful-directory``.
+ > sftp -P 8022 minio@localhost
+ minio@localhost's password:
+ Connected to localhost.
+ sftp> ls runner/
+ chunkdocs testdir
-4. Start or restart the MinIO Server passing the generated public keys
- .. code-block:: bash
- :class: copyable
+ .. tab-item:: FTPS
+ :sync: ftps
- minio server --sftp="address=:8022" --sftp="ssh-private-key=/path/to/ca_user_key" --sftp="trusted-user-ca-key=/path/to/ca_user_key.pub"
+ The following uses the Linux uses the `FTP CLI client `__ to connect to the MinIO server using ``minio`` credentials to list contents in a bucket named ``runner``
-5. Connect to the MinIO Server by sftp
+ .. code-block:: shell
- .. code-block:: bash
- :class: copyable
+ > ftp localhost -P 8021
+ Connected to localhost.
+ 220 Welcome to MinIO FTP Server
+ Name (localhost:user): minio
+ 331 User name ok, password required
+ Password:
+ 230 Password ok, continue
+ Remote system type is UNIX.
+ Using binary mode to transfer files.
+ ftp> ls runner/
+ 229 Entering Extended Passive Mode (|||39155|)
+ 150 Opening ASCII mode data connection for file list
+ drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 chunkdocs/
+ drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 testdir/
+ ...
- sftp -i ./minioadmin -oPort=8022 minioadmin@localhost
+4. Download an Object
-Require service account or LDAP for authentication
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ .. tab-set::
-To force authentication to SFTP using LDAP or service account credentials, append a suffix to the username.
-Valid suffixes are either ``=ldap`` or ``=svc``.
+ .. tab-item:: SFTP/FTP
+ :sync: sftp
-.. code-block:: console
+ This example lists items in a bucket, then downloads the contents of the bucket.
- > sftp -P 8022 my-ldap-user=ldap@[minio@localhost]:/bucket
+ .. code-block:: console
+ > sftp -P 8022 minio@localhost
+ minio@localhost's password:
+ Connected to localhost.
+ sftp> ls runner/
+ chunkdocs testdir
+ sftp> get runner/chunkdocs/metadata metadata
+ Fetching /runner/chunkdocs/metadata to metadata
+ metadata 100% 226 16.6KB/s 00:00
+ sftp>
-.. code-block:: console
+ .. tab-item:: FTPS
+ :sync: ftps
- > sftp -P 8022 my-ldap-user=svc@[minio@localhost]:/bucket
+ This example lists items in a bucket, then downloads the contents of the bucket.
+ .. code-block:: console
-- Replace ``my-ldap-user`` with the username to use.
-- Replace ``[minio@localhost]`` with the address of the MinIO server.
+ > ftp localhost -P 8021
+ Connected to localhost.
+ 220 Welcome to MinIO FTP Server
+ Name (localhost:user): minio
+ 331 User name ok, password required
+ Password:
+ 230 Password ok, continue
+ Remote system type is UNIX.
+ Using binary mode to transfer files.ftp> ls runner/chunkdocs/metadata
+ 229 Entering Extended Passive Mode (|||44269|)
+ 150 Opening ASCII mode data connection for file list
+ -rwxrwxrwx 1 nobody nobody 45 Apr 1 06:13 chunkdocs/metadata
+ 226 Closing data connection, sent 75 bytes
+ ftp> get
+ (remote-file) runner/chunkdocs/metadata
+ (local-file) test
+ local: test remote: runner/chunkdocs/metadata
+ 229 Entering Extended Passive Mode (|||37785|)
+ 150 Data transfer starting 45 bytes
+ 45 3.58 KiB/s
+ 226 Closing data connection, sent 45 bytes
+ 45 bytes received in 00:00 (3.55 KiB/s)
+ ...
diff --git a/source/includes/linux/steps-configure-minio-kes-hashicorp.rst b/source/includes/linux/steps-configure-minio-kes-hashicorp.rst
index 32fe355f8..3302f1c9b 100644
--- a/source/includes/linux/steps-configure-minio-kes-hashicorp.rst
+++ b/source/includes/linux/steps-configure-minio-kes-hashicorp.rst
@@ -1,79 +1,53 @@
-Procedure
----------
+#. Generate a KES API Key for use by MinIO
-This procedure provides instructions for configuring and enabling Server-Side Encryption using your selected `supported KMS solution `__ in production environments.
-Specifically, this procedure assumes the following:
+ Use the :kes-docs:`kes identity new ` command to generate a new API key for use by the MinIO Server:
-- An existing production-grade KMS target
-- One or more KES servers connected to the KMS target
-- One or more hosts for a new or existing MinIO deployment
+ .. code-block:: shell
+ :class: copyable
-Prerequisite
-~~~~~~~~~~~~
+ kes identity new
-Depending on your chosen :kes-docs:`supported KMS target <#supported-kms-targets>` configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority (CA).
-Defer to the client documentation for instructions on trusting a third-party CA.
+ The output includes both the API Key for use with MinIO and the Identity hash for use with the :kes-docs:`KES Policy configuration `.
-1) Generate a KES API Key for use by MinIO
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#. Configure the MinIO Environment File
-Starting with KES version :minio-git:`2023-02-15T14-54-37Z `, you can generate an API key to use for authenticating to the KES server.
+ Create or modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables:
-Use the :kes-docs:`kes identity new ` command to generate a new API key for use by the MinIO Server:
+ .. include:: /includes/common/common-minio-kes.rst
+ :start-after: start-kes-configuration-minio-desc
+ :end-before: end-kes-configuration-minio-desc
-.. code-block:: shell
- :class: copyable
+ MinIO defaults to expecting this file at ``/etc/default/minio``.
+ If you modified your deployment to use a different location for the environment file, modify the file at that location.
- kes identity new
+#. Start MinIO
-The output includes both the API Key for use with MinIO and the Identity hash for use with the :kes-docs:`KES Policy configuration `.
+ .. admonition:: KES Operations Requires Unsealed Vault
+ :class: important
-2) Create the MinIO Configurations
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Depending on your selected KMS solution, you may need to unseal the key instance to allow normal cryptographic operations, including key creation or retrieval.
+ KES requires an unsealed key target to perform its operations.
+
+ Refer to the :kes-docs:`documentation for your chosen KMS solution <#supported-kms-targets>` for information regarding whether sealing and unsealing the instance is required for operations.
-Configure the MinIO Environment File
+ You must start KES *before* starting MinIO.
+ The MinIO deployment requires access to KES as part of its startup.
-Create or modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables:
+ You can use the :mc:`mc admin service restart` command to restart MinIO:
-.. include:: /includes/common/common-minio-kes.rst
- :start-after: start-kes-configuration-minio-desc
- :end-before: end-kes-configuration-minio-desc
+ .. code-block:: shell
+ :class: copyable
-MinIO defaults to expecting this file at ``/etc/default/minio``.
-If you modified your deployment to use a different location for the environment file, modify the file at that location.
+ mc admin service restart ALIAS
-3) Start MinIO
-~~~~~~~~~~~~~~
+#. Generate a New Encryption Key
-.. admonition:: KES Operations Requires Unsealed Vault
- :class: important
+ .. include:: /includes/common/common-minio-kes.rst
+ :start-after: start-kes-generate-key-desc
+ :end-before: end-kes-generate-key-desc
- Depending on your selected KMS solution, you may need to unseal the key instance to allow normal cryptographic operations, including key creation or retrieval.
- KES requires an unsealed key target to perform its operations.
-
- Refer to the :kes-docs:`documentation for your chosen KMS solution <#supported-kms-targets>` for information regarding whether sealing and unsealing the instance is required for operations.
+#. Enable SSE-KMS for a Bucket
- You must start KES *before* starting MinIO.
- The MinIO deployment requires access to KES as part of its startup.
-
-This step uses ``systemd`` for starting and managing the MinIO server processes:
-
-Start the MinIO Server
-
-.. include:: /includes/linux/common-minio-kes.rst
- :start-after: start-kes-minio-start-service-desc
- :end-before: end-kes-minio-start-service-desc
-
-4) Generate a New Encryption Key
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-minio-kes.rst
- :start-after: start-kes-generate-key-desc
- :end-before: end-kes-generate-key-desc
-
-5) Enable SSE-KMS for a Bucket
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-minio-kes.rst
- :start-after: start-kes-enable-sse-kms-desc
- :end-before: end-kes-enable-sse-kms-desc
+ .. include:: /includes/common/common-minio-kes.rst
+ :start-after: start-kes-enable-sse-kms-desc
+ :end-before: end-kes-enable-sse-kms-desc
diff --git a/source/includes/macos/common-installation.rst b/source/includes/macos/common-installation.rst
deleted file mode 100644
index 33826c5ca..000000000
--- a/source/includes/macos/common-installation.rst
+++ /dev/null
@@ -1,77 +0,0 @@
-.. start-install-minio-binary-desc
-
-.. tab-set::
-
- .. tab-item:: Homebrew
-
- Open a Terminal and run the following command to install the latest stable MinIO package using `Homebrew `_.
-
- .. code-block:: shell
- :class: copyable
-
- brew install minio/stable/minio
-
- .. important::
-
- If you previously installed the MinIO server using ``brew install minio``, then we recommend that you reinstall from ``minio/stable/minio`` instead.
-
- .. code-block:: shell
- :class: copyable
-
- brew uninstall minio
- brew install minio/stable/minio
-
- .. tab-item:: Binary - arm64
-
- Open a Terminal, then use the following commands to download the latest stable MinIO binary, set it to executable, and install it to the system ``$PATH``:
-
- .. code-block:: shell
- :class: copyable
-
- curl -O https://dl.min.io/server/minio/release/darwin-arm64/minio
- chmod +x ./minio
- sudo mv ./minio /usr/local/bin/
-
- .. tab-item:: Binary - amd64
-
- Open a Terminal, then use the following commands to download the latest stable MinIO binary, set it to executable, and install it to the system ``$PATH``:
-
- .. code-block:: shell
- :class: copyable
-
- curl -O https://dl.min.io/server/minio/release/darwin-amd64/minio
- chmod +x ./minio
- sudo mv ./minio /usr/local/bin/
-
-.. end-install-minio-binary-desc
-
-.. start-run-minio-binary-desc
-
-From the Terminal, use the :mc:`minio server` to start a local MinIO instance in the ``~/data`` folder.
-If desired, you can replace ``~/data`` with another location to which the user has read, write, and delete access for the MinIO instance.
-
-.. code-block:: shell
- :class: copyable
-
- export MINIO_CONFIG_ENV_FILE=/etc/default/minio
- minio server --console-address :9001
-
-.. code-block:: shell
-
- Status: 1 Online, 0 Offline.
- API: http://192.168.2.100:9000 http://127.0.0.1:9000
- RootUser: myminioadmin
- RootPass: minio-secret-key-change-me
- Console: http://192.168.2.100:9001 http://127.0.0.1:9001
- RootUser: myminioadmin
- RootPass: minio-secret-key-change-me
-
- Command-line: https://min.io/docs/minio/linux/reference/minio-mc.html
- $ mc alias set myminio http://10.0.2.100:9000 myminioadmin minio-secret-key-change-me
-
- Documentation: https://min.io/docs/minio/linux/index.html
-
-The ``API`` block lists the network interfaces and port on which clients can access the MinIO S3 API.
-The ``Console`` block lists the network interfaces and port on which clients can access the MinIO Web Console.
-
-.. end-run-minio-binary-desc
\ No newline at end of file
diff --git a/source/includes/macos/steps-deploy-minio-single-node-multi-drive.rst b/source/includes/macos/steps-deploy-minio-single-node-multi-drive.rst
deleted file mode 100644
index f189a219d..000000000
--- a/source/includes/macos/steps-deploy-minio-single-node-multi-drive.rst
+++ /dev/null
@@ -1,34 +0,0 @@
-1) Download the MinIO Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/macos/common-installation.rst
- :start-after: start-install-minio-binary-desc
- :end-before: end-install-minio-binary-desc
-
-2) Create the Environment Variable File
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-create-environment-file-multi-drive
- :end-before: end-common-deploy-create-environment-file-multi-drive
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-create-unique-root-credentials
- :end-before: end-common-deploy-create-unique-root-credentials
-
-3) Start the MinIO Deployment
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Issue the following command on the local host to start the MinIO |SNSD| deployment as a foreground process.
-You must keep the shell or terminal session open to keep the process running.
-
-.. include:: /includes/macos/common-installation.rst
- :start-after: start-run-minio-binary-desc
- :end-before: end-run-minio-binary-desc
-
-4) Connect to the MinIO Deployment
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-connect-to-minio-deployment
- :end-before: end-common-deploy-connect-to-minio-deployment
\ No newline at end of file
diff --git a/source/includes/macos/steps-deploy-minio-single-node-single-drive.rst b/source/includes/macos/steps-deploy-minio-single-node-single-drive.rst
deleted file mode 100644
index e1ed2f0b5..000000000
--- a/source/includes/macos/steps-deploy-minio-single-node-single-drive.rst
+++ /dev/null
@@ -1,34 +0,0 @@
-1) Download the MinIO Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/macos/common-installation.rst
- :start-after: start-install-minio-binary-desc
- :end-before: end-install-minio-binary-desc
-
-2) Create the Environment Variable File
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-create-environment-file-single-drive
- :end-before: end-common-deploy-create-environment-file-single-drive
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-create-unique-root-credentials
- :end-before: end-common-deploy-create-unique-root-credentials
-
-3) Start the MinIO Deployment
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Issue the following command on the local host to start the MinIO |SNSD| deployment as a foreground process.
-You must keep the shell or terminal session open to keep the process running.
-
-.. include:: /includes/macos/common-installation.rst
- :start-after: start-run-minio-binary-desc
- :end-before: end-run-minio-binary-desc
-
-4) Connect to the MinIO Deployment
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-connect-to-minio-deployment
- :end-before: end-common-deploy-connect-to-minio-deployment
diff --git a/source/includes/macos/steps-upgrade-minio-deployment.rst b/source/includes/macos/steps-upgrade-minio-deployment.rst
deleted file mode 100644
index 8da021960..000000000
--- a/source/includes/macos/steps-upgrade-minio-deployment.rst
+++ /dev/null
@@ -1,78 +0,0 @@
-MinIO uses an update-then-restart methodology for upgrading a deployment to a newer release:
-
-1. Update the MinIO binary with the newer release.
-2. Restart the deployment using :mc-cmd:`mc admin service restart`.
-
-This procedure does not require taking downtime and is non-disruptive to ongoing operations.
-
-This page documents methods for upgrading using the update-then-restart method for both ``systemctl`` and user-managed MinIO deployments.
-Deployments using Ansible, Terraform, or other management tools can use the procedures here as guidance for implementation within the existing automation framework.
-
-Considerations
---------------
-
-Upgrades Are Non-Disruptive
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-MinIO's upgrade-then-restart procedure does *not* require taking downtime or scheduling a maintenance period.
-MinIO restarts are fast, such that restarting all server processes in parallel typically completes in a few seconds.
-MinIO operations are atomic and strictly consistent, such that applications using MinIO or S3 SDKs can rely on the built-in :aws-docs:`transparent retry ` without further client-side logic.
-This ensures upgrades are non-disruptive to ongoing operations.
-
-"Rolling" or serial "one-at-a-time" upgrade methods do not provide any advantage over the recommended "parallel" procedure, and can introduce unnecessary complexity to the upgrade procedure.
-For virtualized environments which *require* rolling updates, you should modify the recommended procedure as follows:
-
-1. Update the MinIO Binary in the virtual machine or container one at a time.
-2. Restart the MinIO deployment using :mc-cmd:`mc admin service restart`.
-3. Update the virtual machine/container configuration to use the matching newer MinIO image.
-4. Perform the rolling restart of each machine/container with the updated image.
-
-Check Release Notes
-~~~~~~~~~~~~~~~~~~~
-
-MinIO publishes :minio-git:`Release Notes ` for your reference as part of identifying the changes applied in each release.
-Review the associated release notes between your current MinIO version and the newer release so you have a complete view of any changes.
-
-Pay particular attention to any releases that are *not* backwards compatible.
-You cannot trivially downgrade from any such release.
-
-Update Using Homebrew
----------------------
-
-For Homebrew installations, you can use homebrew to update the cask:
-
-.. code-block:: shell
- :class: copyable
-
- brew upgrade minio/stable/minio
-
-Restart the MinIO process to complete the update.
-
-Update using Binary Replacement
--------------------------------
-
-.. tab-set::
-
- .. tab-item:: Binary - arm64
-
- Open a Terminal, then use the following commands to download the latest stable MinIO binary, set it to executable, and install it to the system ``$PATH``:
-
- .. code-block:: shell
- :class: copyable
-
- curl -O https://dl.min.io/server/minio/release/darwin-arm64/minio
- chmod +x ./minio
- sudo mv ./minio /usr/local/bin/
-
- .. tab-item:: Binary - amd64
-
- Open a Terminal, then use the following commands to download the latest stable MinIO binary, set it to executable, and install it to the system ``$PATH``:
-
- .. code-block:: shell
- :class: copyable
-
- curl -O https://dl.min.io/server/minio/release/darwin-amd64/minio
- chmod +x ./minio
- sudo mv ./minio /usr/local/bin/
-
-Restart the MinIO process to complete the update.
\ No newline at end of file
diff --git a/source/includes/windows/steps-configure-minio-kes-hashicorp.rst b/source/includes/windows/steps-configure-minio-kes-hashicorp.rst
deleted file mode 100644
index 6ac6bbcd1..000000000
--- a/source/includes/windows/steps-configure-minio-kes-hashicorp.rst
+++ /dev/null
@@ -1,63 +0,0 @@
-Deploy MinIO and KES with Server-Side Encryption
-------------------------------------------------
-
-Prior to starting these steps, create the following folders:
-
-.. code-block:: powershell
- :class: copyable
- :substitutions:
-
- New-Item -Path "|kescertpath|" -ItemType "directory"
- New-Item -Path "|kesconfigpath|" -ItemType "directory"
- New-Item -Path "|miniodatapath|" -ItemType "directory"
-
-Prerequisite
-~~~~~~~~~~~~
-
-Depending on your chosen :kes-docs:`supported KMS target <#supported-kms-targets>` configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority (CA).
-Defer to the client documentation for instructions on trusting a third-party CA.
-
-1) Create the MinIO Configurations
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Create the MinIO Environment File
-
-Create the environment file using your preferred text editor.
-The following example uses the Windows Notepad program:
-
-.. code-block:: powershell
- :substitutions:
-
- notepad |minioconfigpath|\minio
-
-.. include:: /includes/windows/common-minio-kes.rst
- :start-after: start-kes-configuration-minio-desc
- :end-before: end-kes-configuration-minio-desc
-
-2) Start the MinIO Server
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. note::
-
- You **must** start KES *before* starting MinIO.
- The MinIO deployment requires access to KES as part of its startup.
-
-Start the MinIO Server
-
-.. include:: /includes/windows/common-minio-kes.rst
- :start-after: start-kes-minio-start-server-desc
- :end-before: end-kes-minio-start-server-desc
-
-3) Generate a New Encryption Key
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/windows/common-minio-kes.rst
- :start-after: start-kes-generate-key-desc
- :end-before: end-kes-generate-key-desc
-
-4) Enable SSE-KMS for a Bucket
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-minio-kes.rst
- :start-after: start-kes-enable-sse-kms-desc
- :end-before: end-kes-enable-sse-kms-desc
diff --git a/source/includes/windows/steps-deploy-minio-single-node-single-drive.rst b/source/includes/windows/steps-deploy-minio-single-node-single-drive.rst
deleted file mode 100644
index eced268c3..000000000
--- a/source/includes/windows/steps-deploy-minio-single-node-single-drive.rst
+++ /dev/null
@@ -1,53 +0,0 @@
-1) Download the MinIO Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
- Download the MinIO executable from the following URL:
-
- .. code-block:: shell
- :class: copyable
-
- https://dl.min.io/server/minio/release/windows-amd64/minio.exe
-
- The next step includes instructions for running the executable.
- You cannot run the executable from the Explorer or by double clicking the file.
- Instead, you call the executable to launch the server.
-
-2) Prepare the Data Path for MinIO
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Ensure the data path is empty and contains no existing files, including any hidden or Windows system files.
-
-If specifying a drive not dedicated for use by MinIO, consider creating a dedicated folder for storing MinIO data such as ``D:/Minio``.
-
-3) Start the MinIO Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Open the Command Prompt or PowerShell and issue the following command to start the MinIO |SNSD| deployment in that session:
-
-.. code-block:: shell
- :class: copyable
-
- minio.exe server D:/minio --console-address ":9001"
-
-The output should resemble the following:
-
-.. code-block:: shell
-
- Status: 1 Online, 0 Offline.
- API: http://192.168.2.100:9000 http://127.0.0.1:9000
- Console: http://192.168.2.100:9001 http://127.0.0.1:9001
-
- Command-line: https://min.io/docs/minio/linux/reference/minio-mc.html
- $ mc alias set myminio http://10.0.2.100:9000 minioadmin minioadmin
-
- Documentation: https://min.io/docs/minio/linux/index.html
-
-The ``API`` block lists the network interfaces and port on which clients can access the MinIO S3 API.
-The ``Console`` block lists the network interfaces and port on which clients can access the MinIO Web Console.
-
-4) Connect to the MinIO Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-.. include:: /includes/common/common-deploy.rst
- :start-after: start-common-deploy-connect-to-minio-deployment
- :end-before: end-common-deploy-connect-to-minio-deployment
diff --git a/source/index.rst b/source/index.rst
index 6fb0bf1a5..8079c3d7f 100644
--- a/source/index.rst
+++ b/source/index.rst
@@ -1,10 +1,10 @@
-================================================================================
-MinIO Object Storage for |platform|
-================================================================================
+=====================================
+MinIO High Performance Object Storage
+=====================================
.. default-domain:: minio
-.. cond:: container
+.. cond:: mindocs
.. container:: extlinks-video
@@ -14,263 +14,113 @@ MinIO Object Storage for |platform|
- `How to Connect to MinIO with JavaScript `__
-.. cond:: k8s
-
- .. container:: extlinks-video
-
- - `Object Storage Essentials `__
-
- - `How to Connect to MinIO with JavaScript `__
-
-.. cond:: linux
-
- .. container:: extlinks-video
-
- - `Installing and Running MinIO on Linux `__
-
- - `Object Storage Essentials `__
-
- - `How to Connect to MinIO with JavaScript `__
-
-.. cond:: macos
-
- .. container:: extlinks-video
-
- - `Object Storage Essentials `__
-
- - `How to Connect to MinIO with JavaScript `__
-
-.. cond:: windows
-
- .. container:: extlinks-video
-
- - `Object Storage Essentials `__
-
- - `How to Connect to MinIO with JavaScript `__
-
.. contents:: Table of Contents
:local:
:depth: 2
-MinIO is an object storage solution that provides an Amazon Web Services S3-compatible API and supports all core S3 features.
-MinIO is built to deploy anywhere - public or private cloud, baremetal infrastructure, orchestrated environments, and edge infrastructure.
-
-.. cond:: linux
-
- This site documents Operations, Administration, and Development of MinIO deployments on Linux platforms for the latest stable version of MinIO: |minio-tag|.
-
-.. cond:: windows
-
- This site documents Operations, Administration, and Development of MinIO deployments on Windows platforms for the latest stable version of MinIO: |minio-tag|.
-
-.. cond:: macos
-
- This site documents Operations, Administration, and Development of MinIO deployments on macOS platforms for the latest stable version of MinIO: |minio-tag|.
-
-.. cond:: container
-
- This site documents Operations, Administration, and Development of MinIO deployments on Containers for the latest stable version of MinIO: |minio-tag|.
-
-.. cond:: k8s and not (openshift or eks or gke or aks)
-
- This site documents Operations, Administration, and Development of MinIO deployments on Kubernetes platform for the latest stable version of the MinIO Operator: |operator-version-stable|.
-
-.. cond:: openshift
-
- This site documents Operations, Administration, and Development of MinIO deployments on Red Hat Kubernetes distributions for the latest stable version of the MinIO Operator: |operator-version-stable|.
-
- .. important::
-
- Support for deploying the MinIO Operator via the RedHat Marketplace or OperatorHub was removed in 2024.
- MinIO AIStor fully supports installation via the Marketplace and OperatorHub onto enterprise RedHat Kubernetes distributions like OpenShift Container Platform (OCP).
- |subnet| customers can open an issue for further clarification and instructions on migrating to `AIStor `__.
+MinIO is a Kubernetes-native S3-compatible object storage solution designed to deploy wherever your applications are - on premises, in the private cloud, in the public cloud, and edge infrastructure.
+MinIO is designed to support modern application workload patterns where high performance distributed computing meets petabyte-scale storage requirements.
-.. cond:: eks
+This site documents Operations, Administration, and Development of MinIO Community Object Storage deployments on supported platforms.
- This site documents Operations, Administration, and Development of MinIO deployments on `Amazon Elastic Kubernetes Service `__ for the latest stable version of the MinIO Operator: |operator-version-stable|.
+.. todo: More marketing/SEO below?
-.. cond:: gke
+Quickstart
+----------
- This site documents Operations, Administration, and Development of MinIO deployments on `Google Kubernetes Engine `__ for the latest stable version of the MinIO Operator: |operator-version-stable|.
+.. tab-set::
-.. cond:: aks
+ .. tab-item:: Sandbox
- This site documents Operations, Administration, and Development of MinIO deployments on `Azure Kubernetes Engine `__ for the latest stable version of the MinIO Operator: |operator-version-stable|.
+ MinIO maintains a sandbox instance of the community server at https://play.min.io.
+ You can use this instance for experimenting or evaluating the MinIO product on your local system.
-.. cond:: not (eks or aks or gke)
+ Follow the :mc:`mc` CLI :ref:`installation guide ` to install the utility on your local host.
- MinIO is released under dual license `GNU Affero General Public License v3.0 `__ and `MinIO Commercial License `__.
- Deployments registered through |SUBNET| use the commercial license and include access to 24/7 MinIO support.
+ :mc:`mc` includes a pre-configured ``play`` alias for connecting to the sandbox.
+ For example, you can use the following commands to create a bucket and copy objects to ``play``:
-.. cond:: eks
+ .. code-block:: shell
+ :class: copyable
- MinIO is released under dual license `GNU Affero General Public License v3.0 `__ and `MinIO Commercial License `__.
- Deploying MinIO through the :minio-web:`AWS Marketplace ` includes the commercial license and access to 24/7 MinIO support through |SUBNET|.
+ mc mb play/mynewbucket
-.. cond:: gke
+ mc cp /path/to/file play/mynewbucket/prefix/filename.extension
- MinIO is released under dual license `GNU Affero General Public License v3.0 `__ and `MinIO Commercial License `__.
- Deploying MinIO through the :minio-web:`GKE Marketplace ` includes the commercial license and access to 24/7 MinIO support through |SUBNET|.
+ mc stat play/mynewbucket/prefix/filename.extension
-.. cond:: aks
+ .. important::
- MinIO is released under dual license `GNU Affero General Public License v3.0 `__ and `MinIO Commercial License `__.
- Deploying MinIO through the :minio-web:`AKS Marketplace ` includes the commercial license and access to 24/7 MinIO support through |SUBNET|.
+ MinIO's Play sandbox is an ephemeral public-facing deployment with well-known access credentials.
+ Any private, confidential, internal, secured, or other important data uploaded to Play is effectively made public.
+ Exercise caution and discretion in any data you upload to Play.
-You can get started exploring MinIO features using the :ref:`minio-console` and our ``play`` server at https://play.min.io.
-``play`` is a *public* MinIO cluster running the latest stable MinIO server.
-Any file uploaded to ``play`` should be considered public and non-protected.
-For more about connecting to ``play``, see :ref:`MinIO Console play Login `.
+ .. tab-item:: Baremetal
-.. cond:: linux
+ 1. Download the MinIO Server Process for your Operating System
- .. include:: /includes/linux/quickstart.rst
+ Follow the instructions on the `MinIO Download Page `__ for your operating system to download and install the :mc:`minio server` process.
-.. cond:: macos
+ 2. Create a folder for use with MinIO
- .. include:: /includes/macos/quickstart.rst
+ For example, create a folder ``~/minio`` in Linux/MacOS or ``C:\minio`` in Windows.
-.. cond:: windows
+ 3. Start the MinIO Server
- .. include:: /includes/windows/quickstart.rst
+ Run the :mc:`minio server` specifying the path to the directory and the :mc:`~minio server --console-address` parameter to set a static console listen path:
-.. cond:: k8s
+ .. code-block:: shell
+ :class: copyable
- .. include:: /includes/k8s/quickstart.rst
+ minio server ~/minio --console-address :9001
+ # For windows, use minio.exe server ~/minio --console-address :9001`
-.. cond:: container
+ The output includes connection instructions for both :mc:`mc` and connecting to the Console using your browser.
- .. include:: /includes/container/quickstart.rst
+ .. tab-item:: Kubernetes
-.. cond:: k8s
+ Download `minio-dev.yaml `__ to your host machine:
- .. toctree::
- :titlesonly:
- :hidden:
+ .. code-block:: shell
+ :class: copyable
- /operations/installation
- /operations/install-deploy-manage/upgrade-minio-operator
- /operations/deploy-manage-tenants
- /operations/concepts
- /operations/monitoring
- /operations/external-iam
- /operations/server-side-encryption
- /operations/network-encryption
- /operations/cert-manager
- /operations/checklists
- /operations/data-recovery
- /operations/troubleshooting
- /administration/minio-console
- /administration/object-management
- /administration/monitoring
- /administration/identity-access-management
- /administration/server-side-encryption
- /administration/bucket-replication
- /administration/batch-framework
- /administration/concepts
+ curl https://raw.githubusercontent.com/minio/docs/master/source/extra/examples/minio-dev.yaml -O
-.. cond:: windows
+ The file describes two Kubernetes resources:
- .. toctree::
- :titlesonly:
- :hidden:
+ - A new namespace ``minio-dev``, and
+ - A MinIO pod using a drive or volume on the Worker Node for serving data
- /operations/installation
- /operations/concepts
- /operations/monitoring
- /operations/external-iam
- /operations/server-side-encryption
- /operations/network-encryption
- /operations/checklists
- /operations/data-recovery
- /operations/troubleshooting
- /administration/minio-console
- /administration/object-management
- /administration/monitoring
- /administration/identity-access-management
- /administration/server-side-encryption
- /administration/bucket-replication
- /administration/batch-framework
- /administration/concepts
-
-.. cond:: linux or macos or container
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- /operations/installation
- /operations/manage-existing-deployments
- /operations/concepts
- /operations/monitoring
- /operations/external-iam
- /operations/server-side-encryption
- /operations/network-encryption
- /operations/checklists
- /operations/data-recovery
- /operations/troubleshooting
- /administration/minio-console
- /administration/object-management
- /administration/monitoring
- /administration/identity-access-management
- /administration/server-side-encryption
- /administration/bucket-replication
- /administration/batch-framework
- /administration/concepts
-
-.. cond:: not (linux or k8s)
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- Software Development Kits (SDK)
- Security Token Service (STS)
- Object Lambda
- File Transfer Protocol
- MinIO Client
- MinIO Admin Client
- S3 API Compatibility
- Integrations
-
-.. cond:: linux
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- /developers/minio-drivers
- /developers/security-token-service
- /developers/transforms-with-object-lambda
- /developers/file-transfer-protocol
- /reference/minio-mc
- /reference/minio-mc-admin
- /reference/minio-mc-deprecated
- /reference/minio-server/minio-server
- /reference/s3-api-compatibility
- /integrations/integrations
-
-.. cond:: k8s
-
- .. toctree::
- :titlesonly:
- :hidden:
-
- Software Development Kits (SDK)
- /developers/sts-for-operator
- Object Lambda
- /developers/file-transfer-protocol
- MinIO Client
- MinIO Admin Client
- S3 API Compatibility
- Integrations
- /reference/operator-crd
- /reference/operator-chart-values
- /reference/tenant-chart-values
- /reference/operator-environment-variables
+ Use ``kubectl port-forward`` to access the Pod, or create a service for the pod for which you can configure Ingress, Load Balancing, or similar Kubernetes-level networking.
.. toctree::
:titlesonly:
:hidden:
+ /operations/deployments/installation
+ /operations/replication/multi-site-replication
+ /operations/concepts
+ /operations/monitoring
+ /operations/external-iam
+ /operations/server-side-encryption
+ /operations/network-encryption
+ /operations/checklists
+ /operations/data-recovery
+ /operations/troubleshooting
+ /administration/minio-console
+ /administration/object-management
+ /administration/monitoring
+ /administration/identity-access-management
+ /administration/server-side-encryption
+ /administration/bucket-replication
+ /administration/batch-framework
+ /administration/concepts
+ /developers/minio-drivers
+ /developers/security-token-service
+ /developers/transforms-with-object-lambda
+ /developers/file-transfer-protocol
+ /reference/kubernetes
+ /reference/baremetal
+ /reference/s3-api-compatibility
/glossary
+ /integrations/integrations
diff --git a/source/operations/checklists/hardware.rst b/source/operations/checklists/hardware.rst
index 7bedbc8e5..3998cb6b8 100644
--- a/source/operations/checklists/hardware.rst
+++ b/source/operations/checklists/hardware.rst
@@ -43,17 +43,22 @@ Workloads that benefit from storing aged data on lower-cost hardware should inst
See our `Reference Hardware `__ page for a curated selection of servers and storage components from our hardware partners.
-.. cond:: k8s
+.. tab-set::
+ :class: parent
- .. include:: /includes/common/common-checklist.rst
- :start-after: start-k8s-hardware-checklist
- :end-before: end-k8s-hardware-checklist
+ .. tab-item:: Kubernetes
+ :sync: k8s
-.. cond:: not k8s
+ .. include:: /includes/common/common-checklist.rst
+ :start-after: start-k8s-hardware-checklist
+ :end-before: end-k8s-hardware-checklist
- .. include:: /includes/common/common-checklist.rst
- :start-after: start-linux-hardware-checklist
- :end-before: end-linux-hardware-checklist
+ .. tab-item:: Baremetal
+ :sync: baremetal
+
+ .. include:: /includes/common/common-checklist.rst
+ :start-after: start-linux-hardware-checklist
+ :end-before: end-linux-hardware-checklist
.. important::
@@ -202,142 +207,193 @@ Storage
:start-after: start-exclusive-drive-access
:end-before: end-exclusive-drive-access
-.. cond:: k8s
+Recommended Storage Mediums
++++++++++++++++++++++++++++
+
+.. tab-set::
+
+
+ .. tab-item:: Kubernetes
+ :sync: k8s
+
+ MinIO recommends provisioning a storage class for each MinIO Tenant that meets the performance objectives for that tenant.
+
+ Where possible, configure the Storage Class, CSI, or other provisioner underlying the PV to format volumes as XFS to ensure best performance.
+
+ Ensure a consistent underlying storage type (NVMe, SSD, HDD) for all PVs provisioned in a Tenant.
+
+ Ensure the same presented capacity of each PV across all nodes in each Tenant :ref:`server pool `.
+ MinIO limits the maximum usable size per PV to the smallest PV in the pool.
+ For example, if a pool has 15 10TB PVs and 1 1TB PV, MinIO limits the per-PV capacity to 1TB.
+
+ .. tab-item:: Baremetal
+ :sync: baremetal
+
+ MinIO recommends using flash-based storage (NVMe or SSD) for all workload types and scales.
+ Workloads that require high performance should prefer NVMe over SSD.
- MinIO recommends provisioning a storage class for each MinIO Tenant that meets the performance objectives for that tenant.
+ MinIO does not recommends HDD storage for production environments.
+ HDD storage typically does not provide the necessary performance to meet the expectations of modern workloads, and any cost efficiencies at scale are offset by the performance constraints of the medium.
- Where possible, configure the Storage Class, CSI, or other provisioner underlying the PV to format volumes as XFS to ensure best performance.
+Prefer Direct-Attached "Local" Storage (DAS)
+++++++++++++++++++++++++++++++++++++++++++++
- Ensure a consistent underlying storage type (NVMe, SSD, HDD) for all PVs provisioned in a Tenant.
+:abbr:`DAS (Direct-Attached Storage)`, such as locally-attached JBOD (Just a Bunch of Disks) arrays, provide significant performance and consistency advantages over networked (NAS, SAN, NFS) storage.
+
+.. tab-set::
- Ensure the same presented capacity of each PV across all nodes in each Tenant :ref:`server pool `.
- MinIO limits the maximum usable size per PV to the smallest PV in the pool.
- For example, if a pool has 15 10TB PVs and 1 1TB PV, MinIO limits the per-PV capacity to 1TB.
-.. cond:: not k8s
+ .. tab-item:: Kubernetes
+ :sync: k8s
- Recommended Storage Mediums
- +++++++++++++++++++++++++++
+ While MinIO Tenants can make use of remote Persistent Volume (PV) resources, the cost of performing I/O over the network typically constrains overall performance.
- MinIO recommends using flash-based storage (NVMe or SSD) for all workload types and scales.
- Workloads that require high performance should prefer NVMe over SSD.
+ MinIO strongly recommends using CSIs which can provision storage attached to the worker node on which Kubernetes schedules your MinIO pods, such as :minio-docs:`MinIO DirectPV `.
- MinIO deployments using HDD-based storage are best suited as cold-tier targets for :ref:`Object Transition ("Tiering") ` of aged data.
- HDD storage typically does not provide the necessary performance to meet the expectations of modern workloads, and any cost efficiencies at scale are offset by the performance constraints of the medium.
+ For all other cases, make every effort possible to select a CSI which presents the storage to MinIO as if it were a locally-attached filesystem.
+ CSIs which add layers of software or translations between MinIO and the OS-level storage access APIs necessarily increase the complexity of the syste and can contribute to unexpected or undesired behavior.
- Use Direct-Attached "Local" Storage (DAS)
- +++++++++++++++++++++++++++++++++++++++++
+ .. tab-item:: Baremetal
+ :sync: baremetal
- :abbr:`DAS (Direct-Attached Storage)`, such as locally-attached JBOD (Just a Bunch of Disks) arrays, provide significant performance and consistency advantages over networked (NAS, SAN, NFS) storage.
+ Configure the JBOD arrays without any RAID, pooling, or similar software-level layers, such that the storage is presented directly to MinIO.
- .. dropdown:: Network File System Volumes Break Consistency Guarantees
- :class-title: note
+ For virtual machines or systems that require provising storage as a virtual volume, MinIO recommends using thick LUNs only.
- MinIO's strict **read-after-write** and **list-after-write** consistency model requires local drive filesystems.
- MinIO cannot provide consistency guarantees if the underlying storage volumes are NFS or a similar network-attached storage volume.
+.. dropdown:: Network File System Volumes Break Consistency Guarantees
+ :class-title: note
- Use XFS-Formatted Drives with Labels
- ++++++++++++++++++++++++++++++++++++
+ MinIO's strict **read-after-write** and **list-after-write** consistency model requires local drive filesystems.
+ MinIO cannot provide consistency guarantees if the underlying storage volumes are NFS or a similar network-attached storage volume.
- Format drives as XFS and present them to MinIO as a :abbr:`JBOD (Just a Bunch of Disks)` array with no RAID or other pooling configurations.
- Using any other type of backing storage (SAN/NAS, ext4, RAID, LVM) typically results in a reduction in performance, reliability, predictability, and consistency.
- When formatting XFS drives, apply a unique label per drive.
- For example, the following command formats four drives as XFS and applies a corresponding drive label.
+Use XFS-Formatted Drives with Consistent Mounting
++++++++++++++++++++++++++++++++++++++++++++++++++
- .. code-block:: shell
+.. tab-set::
- mkfs.xfs /dev/sdb -L MINIODRIVE1
- mkfs.xfs /dev/sdc -L MINIODRIVE2
- mkfs.xfs /dev/sdd -L MINIODRIVE3
- mkfs.xfs /dev/sde -L MINIODRIVE4
+ .. tab-item:: Kubernetes
+ :sync: k8s
- Mount Drives using ``/etc/fstab``
- +++++++++++++++++++++++++++++++++
+ MinIO recommends formatting the drives underlying MinIO Persistent Volumes as ``xfs``.
- MinIO **requires** that drives maintain their ordering at the mounted position across restarts.
- MinIO **does not** support arbitrary migration of a drive with existing MinIO data to a new mount position, whether intentional or as the result of OS-level behavior.
+ If using a CSI, review the documentation for that CSI and ensure it supports specifying the ``xfs`` filesystem.
+ MinIO strongly recommends avoiding any CSI which formats drives as ``ext4``, ``btrfs`` or other filesystems.
- You **must** use ``/etc/fstab`` or a similar mount control system to mount drives at a consistent path.
- For example:
+ MinIO expects all provisioned Persistent Volumes (PV) to be intended for its exclusive use, where the underlying storage medium guarantees access to the stored data at the assigned mount path.
+ Modifications to the underlying storage medium, including but not limited to external or third-party applications or the arbitrary re-mounting of locally-attached storage, may result in unexpected behavior or data loss.
- .. code-block:: shell
- :class: copyable
+ .. tab-item:: Baremetal
+ :sync: baremetal
- $ nano /etc/fstab
+ Format drives as XFS and present them to MinIO as a :abbr:`JBOD (Just a Bunch of Disks)` array with no RAID or other pooling configurations.
+ Using any other type of backing storage (SAN/NAS, ext4, RAID, LVM) typically results in a reduction in performance, reliability, predictability, and consistency.
- #
- LABEL=MINIODRIVE1 /mnt/drive-1 xfs defaults,noatime 0 2
- LABEL=MINIODRIVE2 /mnt/drive-2 xfs defaults,noatime 0 2
- LABEL=MINIODRIVE3 /mnt/drive-3 xfs defaults,noatime 0 2
- LABEL=MINIODRIVE4 /mnt/drive-4 xfs defaults,noatime 0 2
+ When formatting XFS drives, apply a unique label per drive.
+ For example, the following command formats four drives as XFS and applies a corresponding drive label.
- You can use ``mount -a`` to mount those drives at those paths during initial setup.
- The Operating System should otherwise mount these drives as part of the node startup process.
+ .. code-block:: shell
- MinIO **strongly recommends** using label-based mounting rules over UUID-based rules.
- Label-based rules allow swapping an unhealthy or non-working drive with a replacement that has matching format and label.
- UUID-based rules require editing the ``/etc/fstab`` file to replace mappings with the new drive UUID.
+ mkfs.xfs /dev/sdb -L MINIODRIVE1
+ mkfs.xfs /dev/sdc -L MINIODRIVE2
+ mkfs.xfs /dev/sdd -L MINIODRIVE3
+ mkfs.xfs /dev/sde -L MINIODRIVE4
- .. note::
+ MinIO **requires** that drives maintain their ordering at the mounted position across restarts.
+ MinIO **does not** support arbitrary migration of a drive with existing MinIO data to a new mount position, whether intentional or as the result of OS-level behavior.
- Cloud environment instances which depend on mounted external storage may encounter boot failure if one or more of the remote file mounts return errors or failure.
- For example, an AWS ECS instance with mounted persistent EBS volumes may not boot with the standard ``/etc/fstab`` configuration if one or more EBS volumes fail to mount.
+ You **must** use ``/etc/fstab`` or a similar mount control system to mount drives at a consistent path.
+ For example:
- You can set the ``nofail`` option to silence error reporting at boot and allow the instance to boot with one or more mount issues.
-
- You should not use this option on systems with locally attached disks, as silencing drive errors prevents both MinIO and the OS from responding to those errors in a normal fashion.
+ .. code-block:: shell
+ :class: copyable
+
+ $ nano /etc/fstab
- Disable XFS Retry On Error
- ++++++++++++++++++++++++++
+ #
+ LABEL=MINIODRIVE1 /mnt/drive-1 xfs defaults,noatime 0 2
+ LABEL=MINIODRIVE2 /mnt/drive-2 xfs defaults,noatime 0 2
+ LABEL=MINIODRIVE3 /mnt/drive-3 xfs defaults,noatime 0 2
+ LABEL=MINIODRIVE4 /mnt/drive-4 xfs defaults,noatime 0 2
- MinIO **strongly recommends** disabling `retry-on-error `__ behavior using the ``max_retries`` configuration for the following error classes:
+ You can use ``mount -a`` to mount those drives at those paths during initial setup.
+ The Operating System should otherwise mount these drives as part of the node startup process.
+
+ MinIO **strongly recommends** using label-based mounting rules over UUID-based rules.
+ Label-based rules allow swapping an unhealthy or non-working drive with a replacement that has matching format and label.
+ UUID-based rules require editing the ``/etc/fstab`` file to replace mappings with the new drive UUID.
+
+ .. note::
+
+ Cloud environment instances which depend on mounted external storage may encounter boot failure if one or more of the remote file mounts return errors or failure.
+ For example, an AWS ECS instance with mounted persistent EBS volumes may not boot with the standard ``/etc/fstab`` configuration if one or more EBS volumes fail to mount.
+
+ You can set the ``nofail`` option to silence error reporting at boot and allow the instance to boot with one or more mount issues.
+
+ You should not use this option on systems with locally attached disks, as silencing drive errors prevents both MinIO and the OS from responding to those errors in a normal fashion.
+
+Disable XFS Retry On Error
+++++++++++++++++++++++++++
+
+MinIO **strongly recommends** disabling `retry-on-error `__ behavior using the ``max_retries`` configuration for the following error classes:
+
+- ``EIO`` Error when reading or writing
+- ``ENOSPC`` Error no space left on device
+- ``default`` All other errors
+
+The default ``max_retries`` setting typically directs the filesystem to retry-on-error indefinitely instead of propagating the error.
+MinIO can handle XFS errors appropriately, such that the retry-on-error behavior introduces at most unnecessary latency or performance degradation.
+
+
+.. tab-set::
- - ``EIO`` Error when reading or writing
- - ``ENOSPC`` Error no space left on device
- - ``default`` All other errors
- The default ``max_retries`` setting typically directs the filesystem to retry-on-error indefinitely instead of propagating the error.
- MinIO can handle XFS errors appropriately, such that the retry-on-error behavior introduces at most unnecessary latency or performance degradation.
+ .. tab-item:: Kubernetes
+ :sync: k8s
- The following script iterates through all drives at the specified mount path and sets the XFS ``max_retries`` setting to ``0`` or "fail immediately on error" for the recommended error classes.
- The script ignores any drives not mounted, either manually or through ``/etc/fstab``.
- Modify the ``/mnt/drive`` line to match the pattern used for your MinIO drives.
+ Defer to the documentation for your preferred CSI or StorageClass on options for configuring filesystem-level settings.
- .. code-block:: bash
- :class: copyable
+ .. tab-item:: Baremetal
+ :sync: baremetal
- #!/bin/bash
+ The following script iterates through all drives at the specified mount path and sets the XFS ``max_retries`` setting to ``0`` or "fail immediately on error" for the recommended error classes.
+ The script ignores any drives not mounted, either manually or through ``/etc/fstab``.
+ Modify the ``/mnt/drive`` line to match the pattern used for your MinIO drives.
- for i in $(df -h | grep /mnt/drive | awk '{ print $1 }'); do
- mountPath="$(df -h | grep $i | awk '{ print $6 }')"
- deviceName="$(basename $i)"
- echo "Modifying xfs max_retries and retry_timeout_seconds for drive $i mounted at $mountPath"
- echo 0 > /sys/fs/xfs/$deviceName/error/metadata/EIO/max_retries
- echo 0 > /sys/fs/xfs/$deviceName/error/metadata/ENOSPC/max_retries
- echo 0 > /sys/fs/xfs/$deviceName/error/metadata/default/max_retries
- done
- exit 0
+ .. code-block:: bash
+ :class: copyable
- You must run this script on all MinIO nodes and configure the script to re-run on reboot, as Linux Operating Systems do not typically persist these changes.
- You can use a ``cron`` job with the ``@reboot`` timing to run the above script whenever the node restarts and ensure all drives have retry-on-error disabled.
- Use ``crontab -e`` to create the following job, modifying the script path to match that on each node:
+ #!/bin/bash
- .. code-block:: shell
- :class: copyable
+ for i in $(df -h | grep /mnt/drive | awk '{ print $1 }'); do
+ mountPath="$(df -h | grep $i | awk '{ print $6 }')"
+ deviceName="$(basename $i)"
+ echo "Modifying xfs max_retries and retry_timeout_seconds for drive $i mounted at $mountPath"
+ echo 0 > /sys/fs/xfs/$deviceName/error/metadata/EIO/max_retries
+ echo 0 > /sys/fs/xfs/$deviceName/error/metadata/ENOSPC/max_retries
+ echo 0 > /sys/fs/xfs/$deviceName/error/metadata/default/max_retries
+ done
+ exit 0
+
+ You must run this script on all MinIO nodes and configure the script to re-run on reboot, as Linux Operating Systems do not typically persist these changes.
+ You can use a ``cron`` job with the ``@reboot`` timing to run the above script whenever the node restarts and ensure all drives have retry-on-error disabled.
+ Use ``crontab -e`` to create the following job, modifying the script path to match that on each node:
+
+ .. code-block:: shell
+ :class: copyable
- @reboot /opt/minio/xfs-retry-settings.sh
+ @reboot /opt/minio/xfs-retry-settings.sh
- Use Consistent Drive Type and Capacity
- ++++++++++++++++++++++++++++++++++++++
+Use Consistent Drive Type and Capacity
+++++++++++++++++++++++++++++++++++++++
- Ensure a consistent drive type (NVMe, SSD, HDD) for the underlying storage in a MinIO deployment.
- MinIO does not distinguish between storage types and does not support configuring "hot" or "warm" drives within a single deployment.
- Mixing drive types typically results in performance degradation, as the slowest drives in the deployment become a bottleneck regardless of the capabilities of the faster drives.
+Ensure a consistent drive type (NVMe, SSD, HDD) for the underlying storage in a MinIO deployment.
+MinIO does not distinguish between storage types and does not support configuring "hot" or "warm" drives within a single deployment.
+Mixing drive types typically results in performance degradation, as the slowest drives in the deployment become a bottleneck regardless of the capabilities of the faster drives.
- Use the same capacity and type of drive across all nodes in each MinIO :ref:`server pool `.
- MinIO limits the maximum usable size per drive to the smallest size in the deployment.
- For example, if a deployment has 15 10TB drives and 1 1TB drive, MinIO limits the per-drive capacity to 1TB.
+Use the same capacity and type of drive across all nodes in each MinIO :ref:`server pool `.
+MinIO limits the maximum usable size per drive to the smallest size in the deployment.
+For example, if a deployment has 15 10TB drives and 1 1TB drive, MinIO limits the per-drive capacity to 1TB.
Recommended Hardware Tests
--------------------------
diff --git a/source/operations/checklists/software.rst b/source/operations/checklists/software.rst
index 6dab174dc..b6732c056 100644
--- a/source/operations/checklists/software.rst
+++ b/source/operations/checklists/software.rst
@@ -68,20 +68,7 @@ MinIO Pre-requisites
MinIO Install
-------------
-Install the MinIO server binary across all nodes, ensuring that each node uses the same version of that binary.
-
-.. cond:: linux
-
- See the :ref:`Multi Node Multi Drive deployment guide ` for more information.
-
-.. cond:: container or macos or windows
-
- See the :ref:`Single Node Single Drive deployment guide ` for more information.
-
-.. cond:: k8s
-
- See the :ref:`Deploy MinIO Operator ` and :ref:`Minio Tenant deployment guide ` for more information.
-
+Install a matching version of MinIO across all nodes in the deployment.
Post Install Tasks
------------------
diff --git a/source/operations/concepts.rst b/source/operations/concepts.rst
index 45f0ce7bc..6c2f1ba31 100644
--- a/source/operations/concepts.rst
+++ b/source/operations/concepts.rst
@@ -37,13 +37,9 @@ MinIO can deploy to three types of topologies:
#. :ref:`Multi Node Multi Drive `, multiple MinIO servers with multiple mounted drives or volumes for data
- .. cond:: linux
+ For Baremetal infrastructure, you can install and manage distributed MinIO deployments using Ansible, Terraform, or manual processes
- For example, a production deployment using Ansible, Terraform, or manual processes
-
- .. cond:: k8s
-
- For example, a production deployment using Kubernetes to manage and deploy pods and their associated persistent volume claims.
+ For Kubernetes infrastructure, use the MinIO Operator to manage and deploy distributed MinIO Tenants.
How does a distributed MinIO deployment work?
---------------------------------------------
@@ -109,13 +105,7 @@ Expansion consists of adding one or more :ref:`server pools ` for more information
-
-.. cond:: k8s
-
- See :ref:`Expand a MinIO Tenant ` for more information.
+See :ref:`Baremetal: Expand a MinIO deployment ` and :ref:`Kubernetes: Expand a MinIO Tenant ` for more information on expansion in Baremetal and Kubernetes infrastructures respectively.
For deployments which have multiple server pools, you can :ref:`decommission ` the older pools and migrate that data to the newer pools in the deployment.
Once started, decommissioning cannot be stopped.
diff --git a/source/operations/data-recovery/recover-after-drive-failure.rst b/source/operations/data-recovery/recover-after-drive-failure.rst
index 483b041e4..6578699c5 100644
--- a/source/operations/data-recovery/recover-after-drive-failure.rst
+++ b/source/operations/data-recovery/recover-after-drive-failure.rst
@@ -39,7 +39,7 @@ command unmounts the drive at ``/dev/sdb``:
Remove the failed drive(s) from the node hardware and replace it with known
healthy drive(s). Replacement drives *must* meet the following requirements:
-- :ref:`XFS formatted ` and empty.
+- :ref:`XFS formatted ` and empty.
- Same drive type (e.g. HDD, SSD, NVMe).
- Equal or greater performance.
- Equal or greater capacity.
diff --git a/source/operations/deploy-manage-tenants.rst b/source/operations/deploy-manage-tenants.rst
deleted file mode 100644
index ed8ec7a7f..000000000
--- a/source/operations/deploy-manage-tenants.rst
+++ /dev/null
@@ -1,50 +0,0 @@
-.. _minio-installation:
-
-===============================
-Deploy and Manage MinIO Tenants
-===============================
-
-.. default-domain:: minio
-
-.. contents:: Table of Contents
- :local:
- :depth: 1
-
-The MinIO Kubernetes Operator supports deploying and managing MinIO Tenants onto your Kubernetes cluster through the Operator Console web interface.
-
-
-The following tutorials provide steps for tenant management via the Operator Console and Kustomize:
-
-.. list-table::
- :stub-columns: 1
- :widths: 40 60
- :width: 100%
-
- * - :ref:`minio-k8s-deploy-minio-tenant`
- - Deploy a new MinIO Tenant onto the Kubernetes cluster.
-
- * - :ref:`minio-k8s-modify-minio-tenant`
- - Modify the configuration or topology settings of a MinIO Tenant.
-
- * - :ref:`minio-k8s-upgrade-minio-tenant`
- - Upgrade the MinIO Server version used by a MinIO Tenant.
-
- * - :ref:`minio-k8s-expand-minio-tenant`
- - Increase the available storage capacity of an existing MinIO Tenant.
-
- * - :ref:`minio-k8s-delete-minio-tenant`
- - Delete an existing MinIO Tenant.
-
- * - :ref:`minio-site-replication-overview`
- - Configure two or more MinIO Tenants as peers for MinIO Site Replication
-
-.. toctree::
- :titlesonly:
- :hidden:
-
- /operations/install-deploy-manage/deploy-minio-tenant
- /operations/install-deploy-manage/modify-minio-tenant
- /operations/install-deploy-manage/upgrade-minio-tenant
- /operations/install-deploy-manage/expand-minio-tenant
- /operations/install-deploy-manage/delete-minio-tenant
- /operations/install-deploy-manage/multi-site-replication
diff --git a/source/operations/install-deploy-manage/decommission-server-pool.rst b/source/operations/deployments/baremetal-decommission-server-pool.rst
similarity index 100%
rename from source/operations/install-deploy-manage/decommission-server-pool.rst
rename to source/operations/deployments/baremetal-decommission-server-pool.rst
diff --git a/source/operations/deployments/baremetal-deploy-minio-as-a-container.rst b/source/operations/deployments/baremetal-deploy-minio-as-a-container.rst
new file mode 100644
index 000000000..9d4855b8d
--- /dev/null
+++ b/source/operations/deployments/baremetal-deploy-minio-as-a-container.rst
@@ -0,0 +1,191 @@
+.. _deploy-minio-container:
+
+===========================
+Deploy MinIO as a Container
+===========================
+
+.. default-domain:: minio
+
+.. contents:: Table of Contents
+ :local:
+ :depth: 1
+
+This page documents deploying MinIO as a Container onto any operating system that supports containerized processes.
+
+This documentation assumes installation of Docker, Podman, or a similar runtime which supports the standard container image format.
+MinIO images use `Red Hat Universal Base Image 9 Micro `__.
+
+Functionality and performance of the MinIO container may be constrained by the base OS.
+
+The procedure includes guidance for deploying Single-Node Multi-Drive (SNMD) and Single-Node Single-Drive (SNSD) topologies in support of early development and evaluation environments.
+
+.. important::
+
+ MinIO officially supports containerized Multi-Node Multi-Drive (MNMD) "Distributed" configurations on Kubernetes infrastructures through the MinIO Kubernetes Operator.
+
+ MinIO does not support nor provide instruction for deploying distributed clusters using Docker Swarm, Docker Compose, or any other orchestrated container environment.
+
+Considerations
+--------------
+
+Review Checklists
+~~~~~~~~~~~~~~~~~
+
+Ensure you have reviewed our published Hardware, Software, and Security checklists before attempting this procedure.
+
+Erasure Coding Parity
+~~~~~~~~~~~~~~~~~~~~~
+
+MinIO automatically determines the default :ref:`erasure coding ` configuration for the cluster based on the total number of nodes and drives in the topology.
+You can configure the per-object :term:`parity` setting when you set up the cluster *or* let MinIO select the default (``EC:4`` for production-grade clusters).
+
+Parity controls the relationship between object availability and storage on disk.
+Use the MinIO `Erasure Code Calculator `__ for guidance in selecting the appropriate erasure code parity level for your cluster.
+
+While you can change erasure parity settings at any time, objects written with a given parity do **not** automatically update to the new parity settings.
+
+Container Storage
+~~~~~~~~~~~~~~~~~
+
+This procedure assumes you mount one or more dedicated storage devices to the container to act as persistent storage for MinIO.
+
+Data stored on ephemeral container paths is lost when the container restarts or is deleted.
+Use any such paths at your own risk.
+
+Procedure
+---------
+
+1. Start the Container
+
+This procedure provides instructions for Podman and Docker in rootfull mode.
+For rootless deployments, defer to documentation by each runtime for configuration and container startup.
+
+For all other container runtimes, follow the documentation for that runtime and specify the equivalent options, parameters, or configurations.
+
+.. tab-set::
+
+ .. tab-item:: Podman
+
+ The following command creates a folder in your home directory, then starts the MinIO container using Podman:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mkdir -p ~/minio/data
+
+ podman run \
+ -p 9000:9000 \
+ -p 9001:9001 \
+ --name minio \
+ -v ~/minio/data:/data \
+ -e "MINIO_ROOT_USER=ROOTNAME" \
+ -e "MINIO_ROOT_PASSWORD=CHANGEME123" \
+ quay.io/minio/minio server /data --console-address ":9001"
+
+ The command binds ports ``9000`` and ``9001`` to the MinIO S3 API and Web Console respectively.
+
+ The local drive ``~/minio/data`` is mounted to the ``/data`` folder on the container.
+ You can modify the :envvar:`MINIO_ROOT_USER` and :envvar:`MINIO_ROOT_PASSWORD` variables to change the root login as needed.
+
+ For multi-drive deployments, bind each local drive or folder it's on sequentially-numbered path on the remote.
+ You can then modify the :mc:`minio server` startup to specify those paths:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mkdir -p ~/minio/data-{1..4}
+
+ podman run \
+ -p 9000:9000 \
+ -p 9001:9001 \
+ --name minio \
+ -v /mnt/drive-1:/mnt/drive-1 \
+ -v /mnt/drive-2:/mnt/drive-2 \
+ -v /mnt/drive-3:/mnt/drive-3 \
+ -v /mnt/drive-4:/mnt/drive-4 \
+ -e "MINIO_ROOT_USER=ROOTNAME" \
+ -e "MINIO_ROOT_PASSWORD=CHANGEME123" \
+ quay.io/minio/minio server http://localhost:9000/mnt/drive-{1...4} --console-address ":9001"
+
+ For Windows hosts, specify the local folder path using Windows filesystem semantics ``C:\minio\:/data``.
+
+ .. tab-item:: Docker
+
+ The following command creates a folder in your home directory, then starts the MinIO container using Docker:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mkdir -p ~/minio/data
+
+ docker run \
+ -p 9000:9000 \
+ -p 9001:9001 \
+ --name minio \
+ -v ~/minio/data:/data \
+ -e "MINIO_ROOT_USER=ROOTNAME" \
+ -e "MINIO_ROOT_PASSWORD=CHANGEME123" \
+ quay.io/minio/minio server /data --console-address ":9001"
+
+ The command binds ports ``9000`` and ``9001`` to the MinIO S3 API and Web Console respectively.
+
+ The local drive ``~/minio/data`` is mounted to the ``/data`` folder on the container.
+ You can modify the :envvar:`MINIO_ROOT_USER` and :envvar:`MINIO_ROOT_PASSWORD` variables to change the root login as needed.
+
+ For multi-drive deployments, bind each local drive or folder it's on sequentially-numbered path on the remote.
+ You can then modify the :mc:`minio server` startup to specify those paths:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mkdir -p ~/minio/data-{1..4}
+
+ docker run \
+ -p 9000:9000 \
+ -p 9001:9001 \
+ --name minio \
+ -v /mnt/drive-1:/mnt/drive-1 \
+ -v /mnt/drive-2:/mnt/drive-2 \
+ -v /mnt/drive-3:/mnt/drive-3 \
+ -v /mnt/drive-4:/mnt/drive-4 \
+ -e "MINIO_ROOT_USER=ROOTNAME" \
+ -e "MINIO_ROOT_PASSWORD=CHANGEME123" \
+ quay.io/minio/minio server http://localhost:9000/mnt/drive-{1...4} --console-address ":9001"
+
+ For Windows hosts, specify the local folder path using Windows filesystem semantics ``C:\minio\:/data``.
+
+2. Connect to the Deployment
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. tab-set::
+
+ .. tab-item:: Console
+
+ Open your browser to http://localhost:9000 to open the :ref:`MinIO Console ` login page.
+
+ Log in with the :guilabel:`MINIO_ROOT_USER` and :guilabel:`MINIO_ROOT_PASSWORD`
+ from the previous step.
+
+ .. image:: /images/minio-console/console-login.png
+ :width: 600px
+ :alt: MinIO Console Login Page
+ :align: center
+
+ You can use the MinIO Console for general administration tasks like Identity and Access Management, Metrics and Log Monitoring, or Server Configuration.
+ Each MinIO server includes its own embedded MinIO Console.
+
+ .. tab-item:: CLI
+
+ Follow the :ref:`installation instructions ` for ``mc`` on your local host.
+ Run ``mc --version`` to verify the installation.
+
+ Once installed, create an alias for the MinIO deployment:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mc alias set myminio http://localhost:9000 USERNAME PASSWORD
+
+ Change the hostname, username, and password to reflect your deployment.
+
+
diff --git a/source/operations/deployments/baremetal-deploy-minio-on-macos.rst b/source/operations/deployments/baremetal-deploy-minio-on-macos.rst
new file mode 100644
index 000000000..41be24e54
--- /dev/null
+++ b/source/operations/deployments/baremetal-deploy-minio-on-macos.rst
@@ -0,0 +1,315 @@
+.. _deploy-minio-macos:
+
+=====================
+Deploy MinIO on MacOS
+=====================
+
+.. default-domain:: minio
+
+.. container:: extlinks-video
+
+ - `Object Storage Essentials `__
+
+ - `How to Connect to MinIO with JavaScript `__
+
+This page documents deploying MinIO onto Apple MacOS hosts.
+
+MinIO officially supports MacOS operating systems in service status, which is typically 3 years from initial release.
+At the time of writing, that includes:
+
+- macOS 14 (Sonoma) (**Recommended**)
+- macOS 13 (Ventura)
+- macOS 12 (Monterey)
+
+MinIO *may* run on older or out-of-support macOS releases, with limited support or troubleshooting from either MinIO or RedHat.
+
+MinIO supports both Intel and ARM-based macOS hardware and provides distinct binaries for each architecture.
+Ensure you download the correct binary as per the documentation for your host system.
+
+The procedure includes guidance for deploying Single-Node Multi-Drive (SNMD) and Single-Node Single-Drive (SNSD) topologies in support of early development and evaluation environments.
+
+MinIO does not officially support Multi-Node Multi-Drive (MNMD) "Distributed" configurations on MacOS hosts.
+
+Considerations
+--------------
+
+Review Checklists
+~~~~~~~~~~~~~~~~~
+
+Ensure you have reviewed our published Hardware, Software, and Security checklists before attempting this procedure.
+
+Erasure Coding Parity
+~~~~~~~~~~~~~~~~~~~~~
+
+MinIO automatically determines the default :ref:`erasure coding ` configuration for the cluster based on the total number of nodes and drives in the topology.
+You can configure the per-object :term:`parity` setting when you set up the cluster *or* let MinIO select the default (``EC:4`` for production-grade clusters).
+
+Parity controls the relationship between object availability and storage on disk.
+Use the MinIO `Erasure Code Calculator `__ for guidance in selecting the appropriate erasure code parity level for your cluster.
+
+While you can change erasure parity settings at any time, objects written with a given parity do **not** automatically update to the new parity settings.
+
+Procedure
+---------
+
+1. Download the MinIO Binary
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. tab-set::
+
+ .. tab-item:: Homebrew
+
+ Open a Terminal and run the following command to install the latest stable MinIO package using `Homebrew `_.
+
+ .. code-block:: shell
+ :class: copyable
+
+ brew install minio/stable/minio
+
+ .. important::
+
+ If you previously installed the MinIO server using ``brew install minio``, then we recommend that you reinstall from ``minio/stable/minio`` instead.
+
+ .. code-block:: shell
+ :class: copyable
+
+ brew uninstall minio
+ brew install minio/stable/minio
+
+ .. tab-item:: Binary - arm64
+
+ Open a Terminal, then use the following commands to download the latest stable MinIO binary, set it to executable, and install it to the system ``$PATH``:
+
+ .. code-block:: shell
+ :class: copyable
+
+ curl -O https://dl.min.io/server/minio/release/darwin-arm64/minio
+ chmod +x ./minio
+ sudo mv ./minio /usr/local/bin/
+
+ .. tab-item:: Binary - amd64
+
+ Open a Terminal, then use the following commands to download the latest stable MinIO binary, set it to executable, and install it to the system ``$PATH``:
+
+ .. code-block:: shell
+ :class: copyable
+
+ curl -O https://dl.min.io/server/minio/release/darwin-amd64/minio
+ chmod +x ./minio
+ sudo mv ./minio /usr/local/bin/
+
+2. Enable TLS Connectivity
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can skip this step to deploy without TLS enabled.
+MinIO strongly recommends *against* non-TLS deployments outside of early development.
+
+Create or provide :ref:`Transport Layer Security (TLS) ` certificates to MinIO to automatically enable HTTPS-secured connections between the server and clients.
+
+MinIO expects the default certificate names of ``private.key`` and ``public.crt`` for the private and public keys respectively.
+Place the certificates in a dedicated directory:
+
+.. code-block:: shell
+ :class: copyable
+
+ mkdir -P /opt/minio/certs
+
+ cp private.key /opt/minio/certs
+ cp public.crt /opt/minio/certs
+
+
+MinIO verifies client certificates against the OS/System's default list of trusted Certificate Authorities.
+To enable verification of third-party or internally-signed certificates, place the CA file in the ``/opt/minio/certs/CAs`` folder.
+The CA file should include the full chain of trust from leaf to root to ensure successful verification.
+
+For more specific guidance on configuring MinIO for TLS, including multi-domain support via Server Name Indication (SNI), see :ref:`minio-tls`.
+
+.. dropdown:: Certificates for Early Development
+
+ For local testing or development environments, you can use the MinIO :minio-git:`certgen ` to mint self-signed certificates.
+ For example, the following command generates a self-signed certificate with a set of IP and DNS Subject Alternate Names (SANs) associated to the MinIO Server hosts:
+
+ .. code-block:: shell
+
+ certgen -host "localhost,minio-*.example.net"
+
+ Place the generated ``public.crt`` and ``private.key`` into the ``/path/to/certs`` directory to enable TLS for the MinIO deployment.
+ Applications can use the ``public.crt`` as a trusted Certificate Authority to allow connections to the MinIO deployment without disabling certificate validation.
+
+3. Create the MinIO Environment File
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Create an environment file at ``/etc/default/minio``.
+The MinIO service uses this file as the source of all :ref:`environment variables ` used by MinIO *and* the ``minio.service`` file.
+
+Modify the example to reflect your deployment topology.
+
+.. tab-set::
+
+ .. tab-item:: Single-Node Multi-Drive
+
+ Use Single-Node Multi-Drive deployments in development and evaluation environments.
+ You can also use them for smaller storage workloads which can tolerate data loss or unavailability due to node downtime.
+
+ .. code-block:: shell
+ :class: copyable
+
+ # Set the volumes MinIO uses at startup
+ # The command uses MinIO expansion notation {x...y} to denote a
+ # sequential series.
+ #
+ # The following specifies a single host with 4 drives at the specified location
+ #
+ # The command includes the port that the MinIO server listens on
+ # (default 9000).
+ # If you run without TLS, change https -> http
+
+ MINIO_VOLUMES="https://minio1.example.net:9000/mnt/drive{1...4}/minio"
+
+ # Set all MinIO server command-line options
+ #
+ # The following explicitly sets the MinIO Console listen address to
+ # port 9001 on all network interfaces.
+ # The default behavior is dynamic port selection.
+
+ MINIO_OPTS="--console-address :9001 --certs-dir /opt/minio/certs"
+
+ # Set the root username.
+ # This user has unrestricted permissions to perform S3 and
+ # administrative API operations on any resource in the deployment.
+ #
+ # Defer to your organizations requirements for superadmin user name.
+
+ MINIO_ROOT_USER=minioadmin
+
+ # Set the root password
+ #
+ # Use a long, random, unique string that meets your organizations
+ # requirements for passwords.
+
+ MINIO_ROOT_PASSWORD=minio-secret-key-CHANGE-ME
+
+ .. tab-item:: Single-Node Single-Drive
+
+ Use Single-Node Single-Drive ("Standalone") deployments in early development and evaluation environments.
+ MinIO does not recommend Standalone deployments in production, as the loss of the node or its storage medium results in data loss.
+
+ .. code-block:: shell
+ :class: copyable
+
+ # Set the volume MinIO uses at startup
+ #
+ # The following specifies the drive or folder path
+
+ MINIO_VOLUMES="/mnt/drive1/minio"
+
+ # Set all MinIO server command-line options
+ #
+ # The following explicitly sets the MinIO Console listen address to
+ # port 9001 on all network interfaces.
+ # The default behavior is dynamic port selection.
+
+ MINIO_OPTS="--console-address :9001 --certs-dir /opt/minio/certs"
+
+ # Set the root username.
+ # This user has unrestricted permissions to perform S3 and
+ # administrative API operations on any resource in the deployment.
+ #
+ # Defer to your organizations requirements for superadmin user name.
+
+ MINIO_ROOT_USER=minioadmin
+
+ # Set the root password
+ #
+ # Use a long, random, unique string that meets your organizations
+ # requirements for passwords.
+
+ MINIO_ROOT_PASSWORD=minio-secret-key-CHANGE-ME
+
+Specify any other :ref:`environment variables ` or server command-line options as required by your deployment.
+
+4. Start the MinIO Server
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The following command starts the MinIO Server attached to the current terminal/shell window:
+
+.. code-block:: shell
+ :class: copyable
+
+ export MINIO_CONFIG_ENV_FILE=/etc/default/minio
+ minio server --console-address :9001
+
+The command output resembles the following:
+
+.. code-block:: shell
+
+.. code-block:: shell
+
+ MinIO Object Storage Server
+ Copyright: 2015-2024 MinIO, Inc.
+ License: GNU AGPLv3 - https://www.gnu.org/licenses/agpl-3.0.html
+ Version: RELEASE.2024-06-07T16-42-07Z (go1.22.4 linux/amd64)
+
+ API: https://minio-1.example.net:9000 https://203.0.113.10:9000 https://127.0.0.1:9000
+ RootUser: minioadmin
+ RootPass: minioadmin
+
+ WebUI: https://minio-1.example.net:9001 https://203.0.113.10:9001 https://127.0.0.1:9001
+ RootUser: minioadmin
+ RootPass: minioadmin
+
+ CLI: https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart
+ $ mc alias set 'myminio' 'https://minio-1.example.net:9000' 'minioadmin' 'minioadmin'
+
+ Docs: https://min.io/docs/minio/linux/index.html
+ Status: 1 Online, 0 Offline.
+
+The ``API`` block lists the network interfaces and port on which clients can access the MinIO S3 API.
+The ``Console`` block lists the network interfaces and port on which clients can access the MinIO Web Console.
+
+To run the MinIO server process in the background or as a daemon, defer to your MacOS OS documentation for best practices and procedures.
+
+5. Connect to the Deployment
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. tab-set::
+
+ .. tab-item:: Console
+
+ Open your browser and access any of the MinIO hostnames at port ``:9001`` to open the :ref:`MinIO Console ` login page.
+ For example, ``https://minio1.example.com:9001``.
+
+ Log in with the :guilabel:`MINIO_ROOT_USER` and :guilabel:`MINIO_ROOT_PASSWORD`
+ from the previous step.
+
+ .. image:: /images/minio-console/console-login.png
+ :width: 600px
+ :alt: MinIO Console Login Page
+ :align: center
+
+ You can use the MinIO Console for general administration tasks like Identity and Access Management, Metrics and Log Monitoring, or Server Configuration.
+ Each MinIO server includes its own embedded MinIO Console.
+
+ .. tab-item:: CLI
+
+ Follow the :ref:`installation instructions ` for ``mc`` on your local host.
+ Run ``mc --version`` to verify the installation.
+
+ If your MinIO deployment uses third-party or self-signed TLS certificates, copy the :abbr:`CA (Certificate Authority)` files to ``~/.mc/certs/CAs`` to allow ``mc``
+
+
+ Once installed, create an alias for the MinIO deployment:
+
+ .. code-block:: shell
+ :class: copyable
+
+ mc alias set myminio https://minio-1.example.net:9000 USERNAME PASSWORD
+
+ Change the hostname, username, and password to reflect your deployment.
+ The hostname can be any MinIO node in the deployment.
+ You can also specify the hostname load balancer, reverse proxy, or similar network control plane that handles connections to the deployment.
+
+6. Next Steps
+~~~~~~~~~~~~~
+
+TODO
\ No newline at end of file
diff --git a/source/operations/deployments/baremetal-deploy-minio-on-redhat-linux.rst b/source/operations/deployments/baremetal-deploy-minio-on-redhat-linux.rst
new file mode 100644
index 000000000..1c00780b0
--- /dev/null
+++ b/source/operations/deployments/baremetal-deploy-minio-on-redhat-linux.rst
@@ -0,0 +1,442 @@
+.. _deploy-minio-rhel:
+
+============================
+Deploy MinIO on RedHat Linux
+============================
+
+.. default-domain:: minio
+
+.. contents:: Table of Contents
+ :local:
+ :depth: 1
+
+This page documents deploying MinIO on RedHat Linux operating systems, including distributions that are binary-compatible with RHEL.
+This page makes no distinction or special remarks between RHEL and those distributions, and guidance given for RHEL can typically be applied to those distributions.
+
+MinIO strongly recommends that production deployments use RHEL versions in the **Full Support** or **Maintenance Support** phases of the Red Hat life cycle.
+At the time of writing, that includes:
+
+- RHEL 9.5+ (**Recommended**)
+- RHEL 8.10+
+
+Your organization should have the necessary service contracts with Red Hat to ensure end-to-end supportability of your deployments.
+
+MinIO *may* run on versions of RHEL no longer supported by Red Hat Linux, with limited support or troubleshooting from either MinIO or RedHat.
+
+The procedure focuses on production-grade Multi-Node Multi-Drive (MNMD) "Distributed" configurations.
+|MNMD| deployments provide enterprise-grade performance, availability, and scalability and are the recommended topology for all production workloads.
+
+The procedure includes guidance for deploying Single-Node Multi-Drive (SNMD) and Single-Node Single-Drive (SNSD) topologies in support of early development and evaluation environments.
+
+Considerations
+--------------
+
+Review Checklists
+~~~~~~~~~~~~~~~~~
+
+Ensure you have reviewed our published Hardware, Software, and Security checklists before attempting this procedure.
+
+
+Erasure Coding Parity
+~~~~~~~~~~~~~~~~~~~~~
+
+MinIO automatically determines the default :ref:`erasure coding ` configuration for the cluster based on the total number of nodes and drives in the topology.
+You can configure the per-object :term:`parity` setting when you set up the cluster *or* let MinIO select the default (``EC:4`` for production-grade clusters).
+
+Parity controls the relationship between object availability and storage on disk.
+Use the MinIO `Erasure Code Calculator `__ for guidance in selecting the appropriate erasure code parity level for your cluster.
+
+While you can change erasure parity settings at any time, objects written with a given parity do **not** automatically update to the new parity settings.
+
+Capacity-Based Planning
+~~~~~~~~~~~~~~~~~~~~~~~
+
+MinIO recommends planning storage capacity sufficient to store **at least** 2 years of data before reaching 70% usage.
+Performing :ref:`server pool expansion ` more frequently or on a "just-in-time" basis generally indicates an architecture or planning issue.
+
+For example, consider an application suite expected to produce at least 100 TiB of data per year and a 3 year target before expansion.
+By ensuring the deployment has ~500TiB of usable storage up front, the cluster can safely meet the 70% threshold with additional buffer for growth in data storage output per year.
+
+Consider using the MinIO `Erasure Code Calculator