fix(key-rotation): read MINIO_IDENTITY_OPENID_CLIENT_SECRET, not client-secret

The rotation wrote a key the tenant never read, so minio restarted into CreateContainerConfigError. The key name must match the consumer's secretKeyRef, not a house style.
2026-11-04 03:41:13 +08:00
parent b7de85e01e
commit af45e0f3ac
1 changed files with 5 additions and 1 deletions
@@ -107,7 +107,11 @@ spec:
    secretName: minio-oidc
    secretNamespace: storage
    secretKeys:
-      secret: client-secret
+      # The key name here must match the consumer's secretKeyRef, not a house style.
+      # minio-tenant.yaml reads MINIO_IDENTITY_OPENID_CLIENT_SECRET. While this said
+      # `client-secret`, the tenant failed with CreateContainerConfigError on every
+      # restart and the rotation wrote a key nobody read.
+      secret: MINIO_IDENTITY_OPENID_CLIENT_SECRET
    reload: hot
    consumers:
      - {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}