operator
operator copied to clipboard
Support disabling certificate checks for frequently rotated certificates
Is your feature request related to a problem? Please describe.
We are currently using Hashicorp Vault with Cert-Manager to create, manage and rotate certificates which are used for the external ingress to our minio clusters.
Due to a policy, these certificates are only valid 7 days.
Unfortunately, it is not possible to disable the events created by the minio operator: Minio certificate 'my-minio-cert' is expiring in 6 days
.
Therefore the operator will spam these events although this is intended behaviour.
Describe the solution you'd like
Either on operator-level or tenant-level there should be an option to disable these checks and/or to set a custom threshold (e.g. 1 day).
Describe alternatives you've considered
As it is currently hardcoded, there are no alternative solutions: https://github.com/minio/operator/blob/b7f687075daa103bc6a04e758b327e3a5ead2168/pkg/controller/custom.go#L109-L121
Additional context
Hashicorp Vault recommends issuing short-lived certificates using their PKI mount: https://developer.hashicorp.com/vault/tutorials/secrets-management/pki-engine This works fine for other services, e.g. Traefik Ingress etc.