From 506f618b8af3cebf9334ad90eb1171675f2ceea1 Mon Sep 17 00:00:00 2001 From: rock Date: Sat, 31 Oct 2026 13:06:32 -0700 Subject: [PATCH] fix(minio): enable the OIDC identity provider on the tenant MinIO ships identity_openid disabled by default. Every MINIO_IDENTITY_OPENID_* value was already correct, but without MINIO_IDENTITY_OPENID_ENABLE=on the whole block is inert: the console answered /api/v1/login with {"loginStrategy":"form"} and never rendered an SSO button. Also drop MINIO_IDENTITY_OPENID_CLAIM_PREFIX, which was declared with an empty value. An empty prefix makes the claim resolver prepend nothing and then look for a nested property that cannot exist, so omitting the key is correct. ArgoCD owns this Tenant with selfHeal, so the change has to land in git to survive; a direct kubectl apply was reverted within seconds. --- k8s/infra/minio/minio-tenant.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml index 1dc54f2..a166663 100644 --- a/k8s/infra/minio/minio-tenant.yaml +++ b/k8s/infra/minio/minio-tenant.yaml @@ -107,6 +107,13 @@ spec: # Use external URL for config fetch (hairpins through ingress-nginx); browser # redirects use public URLs embedded in the OIDC metadata response. env: + # MinIO ships identity_openid DISABLED by default, whatever else is set. + # Without this key every other MINIO_IDENTITY_OPENID_* value below is + # inert and the console advertises password login only — it answers + # /api/v1/login with {"loginStrategy":"form"} and never renders an SSO + # button, which is exactly the symptom this tenant showed. + - name: MINIO_IDENTITY_OPENID_ENABLE + value: "on" - name: MINIO_IDENTITY_OPENID_CONFIG_URL # Must use external URL — well-known response contains external issuer/jwks_uri. # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch. @@ -121,8 +128,9 @@ spec: key: MINIO_IDENTITY_OPENID_CLIENT_SECRET - name: MINIO_IDENTITY_OPENID_CLAIM_NAME value: "groups" - - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX - value: "" + # An empty claim prefix is worse than no key: it makes the claim resolver + # prepend nothing and then look for a nested property that cannot exist. + # Omit the key entirely unless a real prefix is needed. - name: MINIO_IDENTITY_OPENID_REDIRECT_URI value: "https://minio.riotpiao.com/oauth_callback" - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME