operator icon indicating copy to clipboard operation
operator copied to clipboard

Support disabling certificate checks for frequently rotated certificates

Open bephinix opened this issue 1 year ago • 0 comments

Is your feature request related to a problem? Please describe.

We are currently using Hashicorp Vault with Cert-Manager to create, manage and rotate certificates which are used for the external ingress to our minio clusters. Due to a policy, these certificates are only valid 7 days. Unfortunately, it is not possible to disable the events created by the minio operator: Minio certificate 'my-minio-cert' is expiring in 6 days. Therefore the operator will spam these events although this is intended behaviour.

Describe the solution you'd like

Either on operator-level or tenant-level there should be an option to disable these checks and/or to set a custom threshold (e.g. 1 day).

Describe alternatives you've considered

As it is currently hardcoded, there are no alternative solutions: https://github.com/minio/operator/blob/b7f687075daa103bc6a04e758b327e3a5ead2168/pkg/controller/custom.go#L109-L121

Additional context

Hashicorp Vault recommends issuing short-lived certificates using their PKI mount: https://developer.hashicorp.com/vault/tutorials/secrets-management/pki-engine This works fine for other services, e.g. Traefik Ingress etc.

bephinix avatar Sep 27 '23 09:09 bephinix