Ansible Role: Minio Server Installation and Configuration

This role install and configure Minio in a linux server.

Requirements

None

Role Variables

Available variables are listed below along with default values (see defaults\main.yaml)

• Wheter to install or not minio server and minio client

  minio_install_server: true
  minio_install_client: true

• Minio server installation details

  Minio UNIX user/group

  minio_group: minio
  minio_user: minio

  Minio installation directories to place server configuration (minio_etc_dir), TLS certificates (minio_cert_dir) and user access policies (minio_policy_dir)

  minio_etc_dir: /etc/minio
  minio_cert_dir: "{{ minio_etc_dir }}/ssl"
  minio_policy_dir: "{{ minio_etc_dir }}/policy"

  Minio server IP address (minio_server_address), if empty server listen in all available IP addresses, and server/console listening ports (minio_server_port and minio_console_port)

  minio_server_port: "9091"
  minio_server_addr: ""
  minio_console_port: "9092"

  Minio admin user and password

  minio_root_user: ""
  minio_root_password: ""

  Minio site region

  minio_site_region: "eu-west-1"

  Minio data directories (minio_server_datadirs) and whether force the creation in case they do not exist (minio_server_make_datadirs)

  minio_server_make_datadirs: true
  minio_server_datadirs:
    - /var/lib/minio

  minio_server_cluster_nodes: []

  Set a list of nodes to create a distributed cluster (Multi-Node Multi-Drive deployment).

  In this mode, ansible will create your server datadirs (minio_serverdata_dirs), but use this list (minio_server_cluster_nodes) for the server startup.

  Multi-drive configuration requires datadirs on separate disks to satisfy Minio's distributed storage requirements.

  See recommendations for using, same configuration in all nodes, sequential hostnames and local-atached storage with sequential mounts in the documentation (https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html)

  Example:

  minio_server_datadirs:
    - '/mnt/disk1/minio'
    - '/mnt/disk2/minio'
    - '/mnt/disk3/minio'
    - '/mnt/disk4/minio'
  minio_server_cluster_nodes:
    - 'https://minio{1...4}.example.net:9091/mnt/disk{1...4}/minio'

• Minio client configuration

  Connection alias name minio_alias and whether validate or not SSL certificates (minio_validate_certificates)

  minio_validate_certificate: true
  minio_alias: "myminio"

• Configuration of TLS

  To enable configuration of TLS set minio_enable_tls to true and provide the private key and public certificate as content loaded into minio_key and minio_cert variables.

  They can be loaded from files using an ansible task like:

  - name: Load tls key and cert from files
  set_fact:
    minio_key: "{{ lookup('file','certificates/{{ inventory_hostname }}_private.key') }}"
    minio_cert: "{{ lookup('file','certificates/{{ inventory_hostname }}_public.crt') }}"
  

  minio_url might be needed in case MinIO Server TLS certificates do not contain any IP Subject Alternative Names (SAN). See MINIO_SERVER_URL environment variable definition.

  minio_url: "https://minio.ricsanfre.com:{{ minio_server_port }}"

• Buckets to be created

  Variable minio_buckets create the list of provided buckets, and applying a specifc policy. For creating the buckets, a modified version of Ansible Module from Alexis Facques is used (https://github.com/alexisfacques/ansible-module-s3-minio-bucket)

  minio_buckets:
    - name: bucket1
      policy: read-only
    - name: bucket2
      policy: read-write
      object_lock: false
    - name: bucket3
      policy: private
      object_lock: true

  NOTE The module use remote connection to Minio Server using Python API (minio python package). Role ensure that PIP is installed and install minio package.

  During bucket creation three types of policy can be specified: private, read-only or read-write buckets.

  Minio object locking can also be enabled or disabled: true or false.

• Users to be created and buckets ACLs

  Users can be automatically created using minio_users variable: a list of users can be provided, each user with three variables name (user name), password (user password) and buckets_acl list of buckets and type of access granted to each bucket (read-only or read-write). The role automatically create policy json files containing the user policy statements and load them into the server.

  Predefined read-only and read-write policies, containing pre-defined access statements, can be used. Custom policies can be also defined using custom policy. In this case list of access statements need to be provided.

  minio_users:
  - name: user1
    password: supers1cret0
    buckets_acl:
      - name: bucket1
        policy: read-write
      - name: bucket2
        policy: read-only
      - name: bucket3
        policy: custom
        custom:
          - rule: |
              "Effect": "Allow",
              "Action": [
                  "s3:GetObject",
                  "s3:DeleteObject",
                  "s3:PutObject",
                  "s3:AbortMultipartUpload",
                  "s3:ListMultipartUploadParts"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket3/*"
              ]
          - rule: |
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket3"
              ]

The previous configuration will create the following policy.json file for the user

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket1",
                "arn:aws:s3:::bucket1/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket2",
                "arn:aws:s3:::bucket2/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:ListMultipartUploadParts",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket3/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket3"
            ]
        }
    ]
}

• Generate Prometheus bearer token

  minio_prometheus_bearer_token: false
  prometheus_bearer_token_output: "{{ minio_etc_dir }}/prometheus_bearer.json"

  Setting minio_prometheus_bearer_token to true, generates a file /etc/minio/prometheus_bearer.json which contains the result of executing the command:

  mc admin prometheus generate myminio -json

• Install MinIO pip library to system packages

  As noted in the pip module documentation:

  Python installations marked externally-managed (as defined by PEP668) cannot be updated by pip versions >= 23.0.1 without the use of a virtual environment or setting the environment variable PIP_BREAK_SYSTEM_PACKAGES=1.

  This (and any other pip environment variables) can be set with minio_pip_environment_vars like so:

  minio_pip_environment_vars:
   PIP_BREAK_SYSTEM_PACKAGES: "1"

• Site Replication

  Variable replication_sites creates the list of multiple independent MinIO deployments to configure as a cluster of replicas called peer sites. For further information on what is replicated across sites refer to the minio documentation (https://min.io/docs/minio/linux/operations/install-deploy-manage/multi-site-replication.html)

  replication_sites:
     - name: myminio2
       url: "http://replication.minio.com:9091"
       admin_user: "myminio2"
       admin_password: "supers1cret02"

  The url is the url of the site that will be replicated to from the currently configured site in the playbook. The admin_user and admin_password variables are authentication credentials for the site to be replicated to with admin privileges.

  As noted in the site-replication documentation

  • Initially, only one of the sites added for replication may have data. After site-replication is successfully configured, this data is replicated to the other (initially empty) sites. Subsequently, objects may be written to any of the sites, and they will be replicated to all other sites.
  • Removing a site is not allowed from a set of replicated sites once configured.
  • All sites must be using the same external IDP(s) if any.
  • For SSE-S3 or SSE-KMS encryption via KMS, all sites must have access to a central KMS deployment. This can be achieved via a central KES server or multiple KES servers (say one per site) connected via a central KMS (Vault) server.

Dependencies

None

Example Playbook

The following playbook install and configure minio server and client, enabling TLS and generating self-signed SSL certificates. It also create some buckets and users with proper ACLs

---
- name: Install and configure Minio Server
  hosts: minio
  become: true
  gather_facts: true
  vars:
    server_hostname: minio.example.com
    ssl_key_size: 4096
    ssl_certificate_provider: selfsigned

  pre_tasks:
    - name: Generate self-signed SSL certificates for minio
      include_tasks: generate_selfsigned_cert.yml
      args:
        apply:
          delegate_to: localhost
          become: false
    - name: Load tls key and cert
      set_fact:
        minio_key: "{{ lookup('file','certificates/' + inventory_hostname + '_private.key') }}"
        minio_cert: "{{ lookup('file','certificates/' + inventory_hostname + '_public.crt') }}"

  roles:
    - role: ricsanfre.minio
      minio_root_user: "miniadmin"
      minio_root_password: "supers1cret0"
      minio_enable_tls: true
      minio_url: "https://{{ server_hostname }}:{{ minio_server_port }}"
      minio_buckets:
        - name: bucket1
          policy: read-write
        - name: bucket2
          policy: read-write
      minio_users:
        - name: user1
          password: supers1cret0
          buckets_acl:
            - name: bucket1
              policy: read-write
            - name: bucket2
              policy: read-only

pre-tasks section include tasks to generate a private key and a self-signed certificate and load them into minio_key and minio_cert variables.

Where generate_selfsigned_cert.yml contain the tasks for generating a Private Key and SSL self-signed certificate:

---
- name: Create private certificate
  openssl_privatekey:
    path: "certificates/{{ inventory_hostname }}_private.key"
    size: "{{ ssl_key_size | int }}"
    mode: 0644

- name: Create CSR
  openssl_csr:
    path: "certificates/{{ inventory_hostname }}_cert.csr"
    privatekey_path: "certificates/{{ inventory_hostname }}_private.key"
    common_name: "{{ server_hostname }}"

- name: Create certificates for keystore
  openssl_certificate:
    csr_path: "certificates/{{ inventory_hostname }}_cert.csr"
    path: "certificates/{{ inventory_hostname }}_public.crt"
    privatekey_path: "certificates/{{ inventory_hostname }}_private.key"
    provider: "{{ ssl_certificate_provider }}"

License

MIT

Author Information

Created by Ricardo Sanchez (ricsanfre) Bucket creation ansible module based on module from Alexix Facques (https://github.com/alexisfacques/ansible-module-s3-minio-bucket)