AWS EKS k8s 1.22+ support
While upgrading from EKS k8s 1.21 to 1.22 and upgrading the cluster to BB 1.34.0, the minio-operator pod fails to properly create the operator-tls
secret required for certificate creation. After doing some research and troubleshooting, it appears that minio has updated the application to list nodes to determine the eks k8s version then create a csr for approval/issuing. For k8s 1.22, minio has moved to a signer of beta.eks.amazonaws.com/app-serving
which is not listed in the clusterrole minio-operator-role
. This update also requires permissions for the minio service account to list nodes which must also be added to the same clusterrole.
below are the errors encountered while viewing the minio-operator pod at startup:
[csr.go:130] Could not retrieve nodes to determine if we are in EKS: nodes is forbidden: User "system:serviceaccount:minio-operator:minio-operator" cannot list resource "nodes" in API group "" at the cluster scope
[operator.go:217] Unexpected error during the creation of the csr/operator-minio-operator-csr: certificatesigningrequests.certificates.k8s.io "operator-minio-operator-csr" is forbidden: user not permitted to approve requests with signerName "beta.eks.amazonaws.com/app-serving"
I created a branch in this repo called bugfix/updates-for-eks
but was unable to create an MR.