74a572a5c4
Switch all MinIO communication from HTTP to HTTPS across the entire stack: - MinIO deployment: mount TLS secret, tcpSocket probes, HTTPS init-buckets - 11 service YAMLs: HTTPS rclone endpoint + CA cert volume mount - Training job template + train.sh: HTTPS for fetch-binaries and uploader - CI pipeline (.gitlab-ci.yml): all 7 rclone exports use HTTPS + CA cert - GitLab runner values: minio-ca-cert ConfigMap volume for CI pods - Rust: CA cert loading via MINIO_CA_CERT_PATH in training_uploader, storage backend, data_acquisition uploader, and k8s_dispatcher - Cert generation script (infra/scripts/generate-minio-tls.sh) Fixes training uploader S3 upload failures caused by with_allow_http(false) connecting to an HTTP endpoint. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
90 lines
2.9 KiB
Bash
Executable File
90 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# generate-minio-tls.sh — One-time: generate CA + server cert for MinIO TLS
|
|
# ---------------------------------------------------------------------------
|
|
# Creates:
|
|
# ConfigMap/minio-ca-cert — CA public cert (mounted everywhere)
|
|
# Secret/minio-tls — server cert+key (mounted only by MinIO)
|
|
#
|
|
# SANs cover all K8s DNS forms for the minio Service in foxhunt namespace.
|
|
# Run from any machine with openssl + kubectl access to the cluster.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
NAMESPACE="${NAMESPACE:-foxhunt}"
|
|
CA_DAYS=3650 # 10 years
|
|
SERVER_DAYS=730 # 2 years
|
|
WORK_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK_DIR"' EXIT
|
|
|
|
echo "=== Generating MinIO TLS certs (workdir: $WORK_DIR) ==="
|
|
|
|
# --- CA (self-signed, 10 years) -------------------------------------------
|
|
openssl genrsa -out "$WORK_DIR/ca.key" 4096
|
|
openssl req -new -x509 \
|
|
-key "$WORK_DIR/ca.key" \
|
|
-out "$WORK_DIR/ca.crt" \
|
|
-days "$CA_DAYS" \
|
|
-subj "/CN=foxhunt-minio-ca/O=foxhunt"
|
|
|
|
# --- Server cert (signed by CA, 2 years) ----------------------------------
|
|
cat > "$WORK_DIR/server.cnf" <<EOF
|
|
[req]
|
|
default_bits = 2048
|
|
prompt = no
|
|
distinguished_name = dn
|
|
req_extensions = v3_req
|
|
|
|
[dn]
|
|
CN = minio
|
|
|
|
[v3_req]
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
DNS.1 = minio
|
|
DNS.2 = minio.${NAMESPACE}
|
|
DNS.3 = minio.${NAMESPACE}.svc
|
|
DNS.4 = minio.${NAMESPACE}.svc.cluster.local
|
|
EOF
|
|
|
|
openssl genrsa -out "$WORK_DIR/private.key" 2048
|
|
openssl req -new \
|
|
-key "$WORK_DIR/private.key" \
|
|
-out "$WORK_DIR/server.csr" \
|
|
-config "$WORK_DIR/server.cnf"
|
|
|
|
openssl x509 -req \
|
|
-in "$WORK_DIR/server.csr" \
|
|
-CA "$WORK_DIR/ca.crt" \
|
|
-CAkey "$WORK_DIR/ca.key" \
|
|
-CAcreateserial \
|
|
-out "$WORK_DIR/public.crt" \
|
|
-days "$SERVER_DAYS" \
|
|
-extensions v3_req \
|
|
-extfile "$WORK_DIR/server.cnf"
|
|
|
|
echo "=== Verifying cert chain ==="
|
|
openssl verify -CAfile "$WORK_DIR/ca.crt" "$WORK_DIR/public.crt"
|
|
|
|
# --- Create K8s resources --------------------------------------------------
|
|
echo "=== Creating ConfigMap/minio-ca-cert ==="
|
|
kubectl -n "$NAMESPACE" create configmap minio-ca-cert \
|
|
--from-file=ca.crt="$WORK_DIR/ca.crt" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
echo "=== Creating Secret/minio-tls ==="
|
|
kubectl -n "$NAMESPACE" create secret generic minio-tls \
|
|
--from-file=public.crt="$WORK_DIR/public.crt" \
|
|
--from-file=private.key="$WORK_DIR/private.key" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
echo "=== Done ==="
|
|
echo "ConfigMap: minio-ca-cert (key: ca.crt)"
|
|
echo "Secret: minio-tls (keys: public.crt, private.key)"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " 1. kubectl apply -f infra/k8s/minio/minio.yaml"
|
|
echo " 2. Verify: kubectl -n $NAMESPACE exec deploy/minio -- curl -s --cacert /root/.minio/certs/CAs/ca.crt https://localhost:9000/minio/health/ready"
|