Enabling domains feature prevents login to console

[dbason]

Expected Behavior

When specifying domains in the features section requests to the domain should work

Current Behavior

Any attempt to log in to the console returns a 401

Steps to Reproduce (for bugs)

1. Deploy a minio tenant
2. Create a DNS entry to the exposed console
3. Attempt to log in to the console

Context

We can't specify domains in the features section

Regression

Your Environment

• Version used (minio-operator): 5.0.0.14
• Environment name and version (e.g. kubernetes v1.17.2): Kubernetes v.1.27.8
• Server type and version:RELEASE.2024-04-06T05-26-02Z
• Link to your deployment file:

spec:
  buckets:
  - name: bucket1
    region: us-east-1
  - name: bucket2
    region: us-east-1
  configuration:
    name: minio-config-secret
  exposeServices:
    console: true
    minio: true
  externalCertSecret:
  - name: api-cert-secret
    type: kubernetes.io/tls
  - name: console-cert-secret
    type: kubernetes.io/tls
  features:
    domains:
      console: https://minio-console.example.com:9443
      minio:
      - https://minio-api.example.com
      - https://minio.test.svc.cluster.local
  image: quay.io/minio/minio:RELEASE.2024-04-06T05-26-02Z
  imagePullPolicy: IfNotPresent
  pools:
  - labels:
      app: minio-tenant
    name: default
    servers: 4
    volumeClaimTemplate:
      metadata:
        name: minio-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
    volumesPerServer: 1
  requestAutoCert: true

See minio/minio#19441 for some discussion of the problem

[jDmacD]

I'm seeing a similar issue. enabling domains results in a 500 error code

{"detailedMessage":"Get \"https://x.x.io/minio/admin/v3/accountinfo\": dial tcp x.x.x.x:443: connect: operation not permitted","message":"invalid session"}

[metalcorpe]

Hello. Similar issue. All started after enabled domain feature to support domain name buckets behind ingress.

{"message":"unable to login due to network error"}

Minio Operator Helm Values

tenant:
  name: myminio
  image:
    repository: quay.io/minio/minio
    tag: RELEASE.2024-10-02T17-50-41Z
    pullPolicy: IfNotPresent
  imagePullSecret: { }
  initContainers: [ ]
  scheduler: { }
  configuration:
    name: myminio-env-configuration
  configSecret:
    name: myminio-env-configuration
    accessKey: minio
    secretKey: minio123
  poolsMetadata:
    annotations: { }
    labels: { }
  pools:
    - servers: 4
      name: pool-0
      volumesPerServer: 4
      size: 10Gi
      storageAnnotations: { }
      storageLabels: { }
      annotations: { }
      labels: { }
      tolerations: [ ]
      nodeSelector: { }
      affinity: { }
      resources: { }
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: "OnRootMismatch"
        runAsNonRoot: true
      containerSecurityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints: [ ]
  mountPath: /export
  subPath: /data
  metrics:
    enabled: false
    port: 9000
    protocol: http
  certificate:
    externalCaCertSecret: [ ]
    externalCertSecret:
      - name: myminio-tls
        type: cert-manager.io/v1
    requestAutoCert: false
    certConfig: { }
  features:
    bucketDNS: true
    domains:
      minio:
        - https://core.minio.domain
      minio-console:
        - https://core.minio-console.domain
    enableSFTP: false
  buckets:
    - name: my-minio-bucket
      objectLock: false
      region: us-east-1
    - name: buckethead
      objectLock: false
      region: eu-west-1
  users: [ ]
  podManagementPolicy: Parallel
  liveness: { }
  readiness: { }
  startup: { }
  lifecycle: { }
  exposeServices: {
    minio: true,
    console: true
  }
  serviceAccountName: ""
  prometheusOperator: false
  logging: { }
  serviceMetadata: { }
  env: [ ]
  priorityClassName: ""
  additionalVolumes: [ ]
  additionalVolumeMounts: [ ]

ingress:
  api:
    enabled: true
    ingressClassName: ""
    labels: { }
    annotations: { }
    tls:
      - hosts:
          - core.minio.domain
        secretName: minio-tls
    host: core.minio.domain
    path: /
    pathType: Prefix
  console:
    enabled: true
    ingressClassName: ""
    labels: { }
    annotations: { }
    tls:
      - hosts:
          - core.minio-console.domain
        secretName: minio-tls
    host: core.minio-console.domain
    path: /
    pathType: Prefix