From af45e0f3ac6a7ca22a6c5a96ab7391615f9e7495 Mon Sep 17 00:00:00 2001 From: rock Date: Wed, 4 Nov 2026 03:41:13 +0800 Subject: [PATCH] fix(key-rotation): read MINIO_IDENTITY_OPENID_CLIENT_SECRET, not client-secret The rotation wrote a key the tenant never read, so minio restarted into CreateContainerConfigError. The key name must match the consumer's secretKeyRef, not a house style. --- k8s/apps/key-rotation-controller/rotations.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/k8s/apps/key-rotation-controller/rotations.yaml b/k8s/apps/key-rotation-controller/rotations.yaml index 558ddab..b7a79ee 100644 --- a/k8s/apps/key-rotation-controller/rotations.yaml +++ b/k8s/apps/key-rotation-controller/rotations.yaml @@ -107,7 +107,11 @@ spec: secretName: minio-oidc secretNamespace: storage secretKeys: - secret: client-secret + # The key name here must match the consumer's secretKeyRef, not a house style. + # minio-tenant.yaml reads MINIO_IDENTITY_OPENID_CLIENT_SECRET. While this said + # `client-secret`, the tenant failed with CreateContainerConfigError on every + # restart and the rotation wrote a key nobody read. + secret: MINIO_IDENTITY_OPENID_CLIENT_SECRET reload: hot consumers: - {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}