Perform MinIO Configurations

Create a Dedicated Access Key/Secret for a Service to Access S3 on MinIO

1. Login to MinIO with Administrator admin Credentials

2. Go to User > Access Keys

   

3. Create access key by Clicking on Create access key +

   Create Access Key/Secret according to your needs

   • Set Access Key/Secret Key (or Use the randomized by MinIO (Recommended))
   • Set the Name and Description for Key Information

   Set Policy

   • Allow to only a <YOUR-BUCKET-NAME> bucket access with User Policy

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": ["s3:*"],
               "Resource": ["arn:aws:s3:::<YOUR-BUCKET-NAME>/*"]
           }
       ]
   }

   

   For this instance, an Access Key/Secret Key for using with Grafana Loki

   • Optionally Set Access Key grafana-loki
   • Optionally Set Secret Key P@ssw0rd
     • You can leave the default generated (Recommended) or change it to be on your own control
   • Policy: Allow Everything to buckets used by Grafana Mimir grafana-loki-tsdb, grafana-loki-ruler with User Policy
   • Set the Name and Description for Key Information
     • Name: grafana-loki
     • Description: Access for Grafana Loki
   • Set Expiry to not expired (Long-live Token)

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": ["s3:*"],
               "Resource": [
                   "arn:aws:s3:::grafana-loki-chunks/*",
                   "arn:aws:s3:::grafana-loki-ruler/*"
               ]
           }
       ]
   }

Create Access Keys List

Use the previous guide to create Access Keys for services by the following.

🟢 Management Instance

9 Access Keys

Service	Policy	Buckets	Long-live Token
Vault	Allow all S3 operations: s3:*	vault	✅
Harbor	Allow all S3 operations: s3:*	harbor	✅
Opstella	Allow all S3 operations: s3:*	opstella-web	✅
GitLab CI	Allow all S3 operations: s3:*	gitlab-ci-caches	✅
GitLab Backup	Allow all S3 operations: s3:*	gitlab-backups	✅
Velero	Allow all S3 operations: s3:*	k8s-velero-backups	✅
Grafana Mimir	Allow all S3 operations: s3:*	grafana-mimir-tsdb grafana-mimir-alertmanager grafana-mimir-ruler	✅
Grafana Loki	Allow all S3 operations: s3:*	grafana-loki-chunks grafana-loki-ruler	✅
Grafana Tempo	Allow all S3 operations: s3:*	grafana-tempo-tsdb	✅

Access Key/Secret Key Testing

You can test your credential with mc, MinIO CLI

🟢 Management Instance

1. Set Alias with Credential

   export MINIO_DSO_ACCESS_KEY="CHANGEME"
   export MINIO_DSO_ACCESS_SECRET="CHANGEME"

   mc alias set minio https://minio-api.${BASE_DOMAIN} \
     ${MINIO_DSO_ACCESS_KEY} ${MINIO_DSO_ACCESS_SECRET}

   Added `minio` successfully.

2. List out of accessable buckets

   mc ls minio

   ... (deducted)
   [XXXX-XX-XX YY:YY:YY +ZZ]     0B opstella-web/
   [XXXX-XX-XX YY:YY:YY +ZZ]     0B vault/

3. Try to write a file, it should writable

   echo "Test MinIO" > test.txt
   mc cp test.txt  minio/opstella-web
   rm test.txt

   ...XXXX/test.txt: 0 B / ? ┃░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓┃

4. Try browsing the bucket, it should be appeared in the bucket

   If success, you may remove the test file.

   

🟢 Management Instance