MinIO 面试题

原始对象 -> [Data Shard 1] [Data Shard 2] ... [Data Shard M] [Parity Shard 1] ... [Parity Shard N]

PUT Object -> Erasure Coding 编码 -> 分片 -> 分布到 N 个不同 Node/Disk -> 写入完成
GET Object -> 并行读取 M 个分片 -> Erasure Coding 解码 -> 重组对象 -> 返回客户端

# 环境变量方式
export MINIO_STORAGE_CLASS_STANDARD=EC:4
export MINIO_STORAGE_CLASS_RRS=EC:2

# mc 命令行设置
mc admin config set myminio storage_class standard=EC:4 rrs=EC:2

apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: minio-tenant
spec:
  pools:
    - servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        spec:
          resources:
            requests:
              storage: 10Ti

apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: production-minio
  namespace: minio
spec:
  image: quay.io/minio/minio:RELEASE.2025-01-20T14-07-27Z
  pools:
    - name: pool-0
      servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        spec:
          storageClassName: local-storage
          resources:
            requests:
              storage: 10Ti
  requestAutoCert: true
  users:
    - name: admin-user
  features:
    enableSFTP: true
    domains:
      console: console.minio.example.com
      minio:
        - minio.example.com
  buckets:
    - name: data-lake
      objectLock: true
    - name: backups
      versioning: true
  configuration:
    name: minio-configuration
  env:
    - name: MINIO_STORAGE_CLASS_STANDARD
      value: "EC:4"
  serviceAccountName: minio-sa

Tenant: production-minio
├── Pool-0（NVMe, 2024 采购）
│   ├── Node-0: 4 x 3.84TB NVMe
│   ├── Node-1: 4 x 3.84TB NVMe
│   ├── Node-2: 4 x 3.84TB NVMe
│   └── Node-3: 4 x 3.84TB NVMe
│
└── Pool-1（SSD, 2025 采购）
    ├── Node-4: 4 x 7.68TB SSD
    ├── Node-5: 4 x 7.68TB SSD
    ├── Node-6: 4 x 7.68TB SSD
    └── Node-7: 4 x 7.68TB SSD

新对象写入 -> MinIO 根据容量和负载选择 Pool -> Pool 内 Erasure Coding 编码 -> 分布至 Pool 内节点

spec:
  pools:
    - name: pool-0
      servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        spec:
          resources:
            requests:
              storage: 10Ti
    - name: pool-1
      servers: 4
      volumesPerServer: 8
      volumeClaimTemplate:
        spec:
          resources:
            requests:
              storage: 20Ti

apiVersion: apps/v1
kind: Deployment
metadata:
  name: minio
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio
  template:
    spec:
      containers:
        - name: minio
          image: quay.io/minio/minio:latest
          args: ["server", "/data"]
          volumeMounts:
            - name: data
              mountPath: /data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: minio-pvc

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: minio
spec:
  serviceName: minio-hl
  replicas: 4
  selector:
    matchLabels:
      app: minio
  template:
    spec:
      containers:
        - name: minio
          image: quay.io/minio/minio:latest
          args:
            - server
            - http://minio-{0...3}.minio-hl.default.svc.cluster.local/data
          volumeMounts:
            - name: data
              mountPath: /data
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 10Ti

kubectl apply -k github.com/minio/operator

apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: production
  namespace: minio
spec:
  pools:
    - servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        spec:
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 10Ti

spec:
  pools:
    - servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        metadata:
          name: data
        spec:
          storageClassName: local-storage
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 10Ti

# MinIO Pod 内部磁盘布局
/export0  -> PV-1 (10TiB)
/export1  -> PV-2 (10TiB)
/export2  -> PV-3 (10TiB)
/export3  -> PV-4 (10TiB)

/export0/
├── .minio.sys/           # MinIO 系统元数据
│   ├── config/           # 配置数据
│   ├── tmp/              # 临时文件
│   └── multipart/        # 分片上传
└── {bucket}/             # 对象数据
    └── {object-key}/     # 实际对象
        ├── xl.meta       # 对象元数据
        └── part.{N}      # 对象分片

# 在现有 Tenant 的 spec.pools 中添加新 Pool
spec:
  pools:
    - name: pool-0
      servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        spec:
          resources:
            requests:
              storage: 10Ti
    - name: pool-1          # 新增
      servers: 4            # 新增
      volumesPerServer: 4   # 新增
      volumeClaimTemplate:  # 新增
        spec:
          resources:
            requests:
              storage: 20Ti

kubectl apply -f tenant.yaml

spec:
  pools:
    - name: pool-0
      servers: 4
      volumesPerServer: 4
      volumeClaimTemplate: ...
  zones:
    - name: zone-0
      pools:
        - name: pool-0
          servers: 4
          volumesPerServer: 4
    - name: zone-1        # 新 Zone
      pools:
        - name: pool-2
          servers: 4
          volumesPerServer: 4

# 标记 Pool 为 decommission 状态
mc admin decommission start myminio/ http://minio-pool-2-{0...3}.minio-hl.ns:9000/data

# 检查 decommission 进度
mc admin decommission status myminio/

# 数据迁移完成后删除 Pool 的 StatefulSet 和 PVC
kubectl delete statefulset minio-pool-2 -n minio

User / Group / Service Account -> Policy -> Resource（Bucket / Object）-> Action（s3:GetObject 等）

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::data-lake",
        "arn:aws:s3:::data-lake/*"
      ]
    },
    {
      "Effect": "Deny",
      "Action": ["s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::data-lake/*"]
    }
  ]
}

# 创建 Policy
mc admin policy create myminio read-only-policy policy-readonly.json

# 列出所有 Policy
mc admin policy list myminio

# 绑定 Policy 到用户
mc admin policy attach myminio read-only-policy --user alice

# 查看用户 Policy
mc admin policy entities myminio --user alice

# 为 Service Account 绑定 Policy
mc admin user svcacct add myminio root --policy policy-readonly.json

# 创建用户组
mc admin group add myminio dev-team alice bob

# 将 Policy 绑定到组
mc admin policy attach myminio dev-access --group dev-team

# 查看组成员
mc admin group info myminio dev-team

# AssumeRole 获取临时凭证
mc admin user svcacct add myminio root --access-key temp-key --secret-key temp-secret --expiry-duration 1h

# 添加复制目标
mc replicate add myminio/source-bucket \
  --remote-bucket arn:minio:replication::destination-bucket:dest-instance \
  --replicate "delete-marker,delete,existing-objects"

# 查看复制规则
mc replicate ls myminio/source-bucket

{
  "Role": "arn:minio:replication::dest:dest",
  "Rules": [
    {
      "Status": "Enabled",
      "Priority": 1,
      "DeleteMarkerReplication": {"Status": "Enabled"},
      "DeleteReplication": {"Status": "Enabled"},
      "Filter": {
        "Prefix": "important/",
        "Tag": {"Key": "replicate", "Value": "true"}
      },
      "Destination": {
        "Bucket": "arn:aws:s3:::dest-bucket",
        "StorageClass": "STANDARD"
      }
    }
  ]
}

# 站点 A 添加对等站点
mc admin replicate add site-a site-b site-c

# 查看复制状态
mc admin replicate status site-a

# 查看复制差异
mc admin replicate diff site-a --site site-b

# 恢复复制同步
mc admin replicate resync start site-a site-b

# 启用 Bucket Versioning
mc version enable myminio/financial-records

# 暂停 Versioning
mc version suspend myminio/financial-records

# 查看所有版本
mc ls --versions myminio/financial-records/

# 恢复 Delete Marker 删除的对象
mc rm --versions myminio/financial-records/report.pdf --version-id <delete-marker-id>

# 创建带 Object Lock 的 Bucket
mc mb --with-lock myminio/financial-records

# 设置默认保留策略
mc retention set governance 365d myminio/financial-records

# 放置 Legal Hold
mc legalhold set myminio/financial-records/contract-2024.pdf

# Operator Tenant 中声明 Object Lock Bucket
spec:
  buckets:
    - name: financial-records
      objectLock: true
      objectLockConfig:
        mode: COMPLIANCE
        validity: 2555d  # 7 年
        unit: Days

# Governance 模式下，具备 BypassGovernanceRetention 权限的用户可删除
mc admin policy create myminio bypass-governance bypass-policy.json
mc admin policy attach myminio bypass-governance --user compliance-officer

<LifecycleConfiguration>
  <Rule>
    <ID>Expire logs after 30 days</ID>
    <Filter>
      <Prefix>logs/</Prefix>
    </Filter>
    <Status>Enabled</Status>
    <Expiration>
      <Days>30</Days>
    </Expiration>
  </Rule>
  <Rule>
    <ID>Transition to warm tier after 90 days</ID>
    <Filter>
      <Prefix>data/</Prefix>
    </Filter>
    <Status>Enabled</Status>
    <Transition>
      <Days>90</Days>
      <StorageClass>WARM</StorageClass>
    </Transition>
  </Rule>
  <Rule>
    <ID>Clean old versions</ID>
    <Status>Enabled</Status>
    <NoncurrentVersionExpiration>
      <NoncurrentDays>60</NoncurrentDays>
    </NoncurrentVersionExpiration>
  </Rule>
</LifecycleConfiguration>

mc ilm import myminio/data-lake < lifecycle.xml
mc ilm ls myminio/data-lake
mc ilm rm --id "Expire logs after 30 days" myminio/data-lake

# 添加 Warm Tier（AWS S3）
mc ilm tier add minio myminio WARM --endpoint s3.amazonaws.com \
  --access-key AKIAXXXX --secret-key xxxx \
  --bucket warm-bucket --prefix minio-warm/ --storage-class STANDARD

# 添加 Cold Tier（Azure Blob）
mc ilm tier add minio myminio COLD --endpoint https://storageaccount.blob.core.windows.net \
  --account-name storageaccount --account-key xxxx \
  --bucket cold-bucket

# 查看 Tier 配置
mc ilm tier ls myminio

# 添加 Webhook 通知目标
mc admin config set myminio notify_webhook:image-processor \
  endpoint="http://image-service.ns.svc.cluster.local:8080/events" \
  auth_token="Bearer xxxx"

# 绑定事件到 Bucket
mc event add myminio/images arn:minio:sqs::image-processor:webhook \
  --event "s3:ObjectCreated:Put,s3:ObjectCreated:CompleteMultipartUpload"

# 查看 Bucket 事件配置
mc event ls myminio/images arn:minio:sqs::image-processor:webhook

mc admin config set myminio notify_kafka:audit-logs \
  brokers="kafka-0.kafka-hl.ns:9092,kafka-1.kafka-hl.ns:9092" \
  topic="minio-events" \
  sasl="plain" \
  sasl_username="minio-producer" \
  sasl_password="xxxx" \
  client_tls_cert="user.crt" \
  client_tls_key="user.key"

# 前缀过滤：仅通知特定路径
mc event add myminio/images arn:minio:sqs::image-processor:webhook \
  --prefix "uploads/2025/" --suffix ".jpg"

# 按事件类型过滤
mc event add myminio/data arn:minio:sqs::audit-logs:kafka \
  --event "s3:ObjectCreated:Put,s3:ObjectRemoved:Delete"

{
  "EventName": "s3:ObjectCreated:Put",
  "Key": "images/photo.jpg",
  "Records": [{
    "s3": {
      "bucket": {"name": "images"},
      "object": {
        "key": "images/photo.jpg",
        "size": 1048576,
        "eTag": "d41d8cd98f00b204e9800998ecf8427e",
        "userMetadata": {"Content-Type": "image/jpeg"}
      }
    }
  }]
}

mc admin config set myminio identity_ldap \
  server_addr="ldap.company.com:636" \
  lookup_bind_dn="cn=minio-admin,dc=company,dc=com" \
  lookup_bind_password="xxxx" \
  user_dn_search_base_dn="dc=company,dc=com" \
  user_dn_search_filter="(&(objectClass=user)(sAMAccountName=%s))" \
  group_search_base_dn="ou=groups,dc=company,dc=com" \
  group_search_filter="(&(objectClass=group)(member=%d))"

# 重启以应用配置
mc admin service restart myminio

apiVersion: minio.min.io/v2
kind: Tenant
spec:
  configuration:
    name: minio-configuration
apiVersion: v1
kind: Secret
metadata:
  name: minio-configuration
  namespace: minio
stringData:
  config.env: |
    MINIO_IDENTITY_OPENID_CONFIG_URL=http://keycloak.ns.svc:8080/realms/production/.well-known/openid-configuration
    MINIO_IDENTITY_OPENID_CLIENT_ID=minio-console
    MINIO_IDENTITY_OPENID_CLIENT_SECRET=xxxx
    MINIO_IDENTITY_OPENID_DISPLAY_NAME=Enterprise SSO
    MINIO_IDENTITY_OPENID_SCOPES=openid,profile,groups,email
    MINIO_IDENTITY_OPENID_REDIRECT_URI=https://console.minio.example.com/oauth_callback
    MINIO_IDENTITY_OPENID_CLAIM_NAME=policy
    MINIO_IDENTITY_OPENID_CLAIM_USERINFO=true    

# 创建用户
mc admin user add myminio alice password123

# 查看用户列表
mc admin user list myminio

# 禁用/启用用户
mc admin user disable myminio alice
mc admin user enable myminio alice

# 查看用户 Policy
mc admin user info myminio alice

# 创建 Service Account
mc admin user svcacct add myminio root --name "ci-pipeline"

# 创建带时间限制的 Service Account
mc admin user svcacct add myminio root --name "temp-access" --expiry "2025-12-31"

# 列出用户下的 Service Account
mc admin user svcacct ls myminio root

MinIO Server -> KES Server -> KMS Backend（HashiCorp Vault / AWS KMS / Azure Key Vault / Gemalto）

apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: production
spec:
  kes:
    image: quay.io/minio/kes:latest
    replicas: 1
    keyName: minio-encryption-key
    configuration:
      name: kes-configuration
    env:
      - name: KES_CLIENT_TLS_CERT_FILE
        value: /tmp/kes/cert/tls.crt
      - name: KES_CLIENT_TLS_KEY_FILE
        value: /tmp/kes/cert/tls.key
apiVersion: v1
kind: Secret
metadata:
  name: kes-configuration
stringData:
  server-config.yaml: |
    address: 0.0.0.0:7373
    root: disabled
    tls:
      key: /tmp/kes/cert/tls.key
      cert: /tmp/kes/cert/tls.crt
    keystore:
      vault:
        endpoint: https://vault.internal:8200
        prefix: kes
        approle:
          id: minio-kes-role-id
          secret: minio-kes-role-secret
          retry: 15s
        tls:
          ca: /tmp/kes/cert/vault-ca.crt
        status:
          ping: 10s    

# 创建加密密钥
kes key create minio-default-key

# 列出所有密钥
kes key list

# 查看密钥状态
kes key info minio-default-key

# 加密/解密数据
kes encrypt minio-default-key plaintext.bin > ciphertext.bin
kes decrypt minio-default-key ciphertext.bin > plaintext.bin

# 设置 Bucket 默认加密为 SSE-KMS
mc encrypt set sse-kms minio-default-key myminio/financial-data

# 查看 Bucket 加密配置
mc encrypt info myminio/financial-data

# SSE-C 上传对象
mc cp --encrypt-key "myalias/key=32bytebase64key" file.txt myminio/bucket/

apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
  name: minio
  namespace: minio
spec:
  podMetricsEndpoints:
    - port: https-minio
      path: /minio/v2/metrics/cluster
      scheme: https
      tlsConfig:
        insecureSkipVerify: true
      interval: 30s
    - port: https-minio
      path: /minio/v2/metrics/node
      scheme: https
      interval: 30s
    - port: https-minio
      path: /minio/v2/metrics/bucket
      scheme: https
      interval: 60s
  selector:
    matchLabels:
      v1.min.io/tenant: production

# 获取 Dashboard ID
# MinIO Dashboard: 13502
# MinIO Cluster Dashboard: 13523

# 启用 HTTP 审计日志
mc admin config set myminio audit_webhook:audit endpoint="http://logstash.ns:8080/audit"

# 启用 Kafka 审计日志
mc admin config set myminio audit_kafka:audit \
  brokers="kafka:9092" \
  topic="minio-audit-logs"

# 查看审计日志配置
mc admin config get myminio audit_kafka

groups:
  - name: minio
    rules:
      - alert: MinioDiskSpaceLow
        expr: minio_node_disk_free_bytes / minio_node_disk_total_bytes < 0.1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "MinIO 磁盘空间不足（剩余 < 10%）"

      - alert: MinioClusterOffline
        expr: minio_cluster_nodes_offline_total > 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "MinIO 集群存在离线节点"

      - alert: MinioHighErrorRate
        expr: rate(minio_s3_requests_errors_total[5m]) / rate(minio_s3_requests_total[5m]) > 0.05
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "MinIO 请求错误率超过 5%"

检测到损坏分片 -> 读取 M 个完好分片 -> EC 解码 -> 重新计算损坏分片
-> 写入新分片到健康磁盘 -> 更新元数据

# 查看 Healing 状态
mc admin heal myminio

# 对指定 Bucket 执行 Healing
mc admin heal --recursive myminio/data-lake

# 对指定 Prefix 执行 Healing
mc admin heal --recursive myminio/data-lake/important/

# 检查但不修复（Dry Run）
mc admin heal --dry-run myminio

# 后台 Healing 配置
mc admin config set myminio heal \
  max_sleep=1s \
  max_io=10

# 全量 Bit Rot 扫描
mc admin scanner start myminio

# 查看扫描状态
mc admin scanner status myminio

# 扫描指定 Bucket
mc admin scanner start myminio/data-lake

# 单向镜像同步
mc mirror myminio/source-bucket backup-minio/target-bucket

# 持续 Watch 模式同步
mc mirror --watch myminio/production backup-minio/production

# 排除指定模式
mc mirror --exclude "*.tmp" --exclude "cache/*" myminio/data backup-minio/data

# 仅保留源端存在但目标端不存在的差异
mc mirror --overwrite --remove myminio/data backup-minio/data

# 配置 rclone Remote
rclone config

# 同步 Bucket
rclone sync minio:source-bucket s3:backup-bucket \
  --progress --transfers 16 --checkers 32

# 增量复制
rclone copy minio:data-lake azure:archive \
  --min-age 30d --max-age 90d

# 校验数据完整性
rclone check minio:data-lake s3:backup-bucket --checksum

apiVersion: velero.io/v1
kind: Backup
metadata:
  name: minio-full-backup
spec:
  includedNamespaces:
    - minio
  includedResources:
    - tenant.minio.min.io
    - statefulsets.apps
    - persistentvolumeclaims
    - secrets

velero backup create minio-backup --include-namespaces minio \
  --include-resources tenant.minio.min.io,statefulsets,pvc,secrets
velero restore create --from-backup minio-backup

# CPU 隔离：将 MinIO 绑定到特定 NUMA Node
taskset -c 0-15 minio server /data{1...4}

# 网络中断绑核：网卡中断绑定到同 NUMA Node
echo 0-15 > /proc/irq/<irq_num>/smp_affinity_list

export MINIO_API_REQUESTS_MAX=0  # 0 表示无限制
export MINIO_ROOT_USER=admin
export MINIO_ROOT_PASSWORD=xxxx
export MINIO_STORAGE_CLASS_STANDARD=EC:4

spec:
  containers:
    - name: minio
      resources:
        requests:
          cpu: "16"
          memory: "64Gi"
        limits:
          cpu: "16"
          memory: "64Gi"
      env:
        - name: MINIO_API_REQUESTS_MAX
          value: "0"

http://console.minio.example.com:9090  (HTTP)
https://console.minio.example.com:9443 (HTTPS)

spec:
  features:
    domains:
      console: console.minio.example.com
  requestAutoCert: true

# 修改 Console 访问端口
mc admin config set myminio api console_port=9443

# 禁用 Console（仅 API 访问）
export MINIO_BROWSER=off

# Team-A Tenant
apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: team-a
  namespace: team-a
spec:
  pools:
    - servers: 4
      volumesPerServer: 4
# Team-B Tenant
apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: team-b
  namespace: team-b
spec:
  pools:
    - servers: 4
      volumesPerServer: 4

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:*"],
      "Resource": [
        "arn:aws:s3:::team-a-bucket",
        "arn:aws:s3:::team-a-bucket/*"
      ]
    },
    {
      "Effect": "Deny",
      "Action": ["s3:*"],
      "Resource": [
        "arn:aws:s3:::team-b-bucket",
        "arn:aws:s3:::team-b-bucket/*"
      ]
    }
  ]
}

# Team-A 开发人员：仅 Team-A Bucket 读写
mc admin policy create myminio team-a-dev << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
    "Resource": ["arn:aws:s3:::team-a-*", "arn:aws:s3:::team-a-*/*"]
  }]
}
EOF

mc admin policy attach myminio team-a-dev --user dev-alice

# 设置 Bucket 容量配额
mc quota set myminio/team-a-data --size 100GiB

# 设置 Bucket 对象数量配额
mc quota set myminio/team-a-data --objects 1000000

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: minio-tenant-a
  namespace: minio
spec:
  podSelector:
    matchLabels:
      v1.min.io/tenant: tenant-a
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              team: team-a
      ports:
        - port: 9000

graph TD
    subgraph SiteA["Site A（北京）"]
        IAM["IAM/User"]
        Buckets["Buckets"]
        Objects["Objects"]
    end
    SiteA -->|"Site Replication"| SiteB["Site B<br/>（上海）"]
    SiteA -->|"Site Replication"| SiteC["Site C<br/>（广州）"]
    SiteA -->|"Site Replication"| SiteD["Site D<br/>（新加坡）"]

# 1. 为每个站点创建别名
mc alias set site-a https://minio-site-a.example.com admin xxxx
mc alias set site-b https://minio-site-b.example.com admin xxxx
mc alias set site-c https://minio-site-c.example.com admin xxxx

# 2. 建立 Site Replication
mc admin replicate add site-a site-b site-c

# 3. 查看同步状态
mc admin replicate status site-a

# 4. 检查同步差异
mc admin replicate diff site-a --site site-b

# 5. 手动触发重新同步
mc admin replicate resync start site-a site-b

# 6. 查看恢复同步进度
mc admin replicate resync status site-a site-b

# Bucket 级别复制（双向）
mc replicate add myminio/data-lake \
  --remote-bucket arn:minio:replication::data-lake-backup:remote-minio \
  --replicate "delete-marker,delete,existing-objects" \
  --priority 1

# 带筛选条件的复制
mc replicate add myminio/data-lake \
  --remote-bucket arn:minio:replication::archive:archive-minio \
  --replicate "delete-marker" \
  --tags "environment=production" \
  --storage-class "GLACIER"

# 导出当前规则
mc replicate export myminio/data-lake > replication-rules.json

# 编辑后重新导入
mc replicate import myminio/data-lake < updated-rules.json

graph TD
    subgraph MinIO本地集群
        Hot["Hot Tier - NVMe\n0 - 30 天"]
        Warm["Warm Tier - HDD/SSD\n30 - 90 天"]
    end
    MinIO本地集群 -->|Transition Rule| Cold
    subgraph Cold["Cold Tier - 远端对象存储"]
        S3["AWS S3\nGlacier"]
        Azure["Azure Blob\nCool Tier"]
        Remote["Remote MinIO\nCluster"]
    end

# 添加 AWS S3 作为 Warm Tier
mc ilm tier add minio myminio WARM \
  --endpoint https://s3.amazonaws.com \
  --access-key AKIAXXXX --secret-key xxxx \
  --bucket archive-tier --prefix minio-warm/ \
  --storage-class STANDARD_IA

# 添加 Azure Blob 作为 Cold Tier
mc ilm tier add minio myminio COLD \
  --endpoint https://storageacc.blob.core.windows.net \
  --account-name storageacc --account-key xxxx \
  --bucket cold-container

# 添加 GCS 作为 Cold Tier
mc ilm tier add minio myminio COLD_GCS \
  --endpoint https://storage.googleapis.com \
  --access-key xxxx --secret-key xxxx \
  --bucket gcs-cold-bucket

# 查看所有 Tier
mc ilm tier ls myminio

<LifecycleConfiguration>
  <!-- 30天后迁移到 Warm Tier -->
  <Rule>
    <ID>move-to-warm</ID>
    <Filter><Prefix>data/</Prefix></Filter>
    <Status>Enabled</Status>
    <Transition>
      <Days>30</Days>
      <StorageClass>WARM</StorageClass>
    </Transition>
  </Rule>
  <!-- 90天后迁移到 Cold Tier -->
  <Rule>
    <ID>move-to-cold</ID>
    <Filter><Prefix>data/</Prefix></Filter>
    <Status>Enabled</Status>
    <Transition>
      <Days>90</Days>
      <StorageClass>COLD</StorageClass>
    </Transition>
  </Rule>
</LifecycleConfiguration>

# 设置容量配额
mc quota set myminio/log-bucket --size 500GiB

# 设置对象数量配额
mc quota set myminio/data-bucket --objects 10000000

# 设置 FIFO 配额
mc quota set myminio/events --size 200GiB --type fifo

# 查看 Bucket 配额
mc quota info myminio/data-bucket

# 清除配额
mc quota clear myminio/data-bucket

Tenant: platform
├── Bucket: team-a-prod（Hard Quota: 2TiB）
│   ├── User: team-a-dev（readwrite）
│   └── User: team-a-viewer（readonly）
├── Bucket: team-b-prod（Hard Quota: 2TiB）
│   └── User: team-b-dev（readwrite）
└── Bucket: shared-logs（FIFO Quota: 500GiB）
    ├── User: team-a-dev（readwrite）
    └── User: team-b-dev（readwrite）

- alert: MinioBucketQuotaNearLimit
  expr: (minio_bucket_usage_total_bytes / minio_bucket_quota_total_bytes) > 0.85
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: "Bucket XQOPEN $labels.bucket XQCLOSE 容量使用超过 85%"

Client -> Sidekick (LB) -> MinIO Node 0
                        -> MinIO Node 1
                        -> MinIO Node 2
                        -> MinIO Node 3

# Sidekick 启动
sidekick \
  --health-path=/minio/health/cluster \
  --address :9000 \
  http://minio-{0...3}.minio-hl.ns.svc:9000

graph TD
    MinIO["MinIO Server"]
    MinIO -->|SSE-KMS 请求| KES["KES Server"]
    KES --> KeyMgmt["Key Management Layer"]
    KeyMgmt --> Vault["Vault Backend"]
    KeyMgmt --> AWSKMS["AWS KMS Backend"]
    KeyMgmt --> AzureKV["Azure Key Vault"]
    MinIO -.-|TLS mTLS| KES

apiVersion: minio.min.io/v2
kind: Tenant
spec:
  kes:
    replicas: 2
    image: quay.io/minio/kes:latest
    keyName: minio-default-key
    configuration:
      name: kes-configuration
    env:
      - name: KES_CLIENT_TLS_CERT_FILE
        value: /tmp/kes/cert/tls.crt
      - name: KES_SERVER_TLS_CERT_FILE
        value: /tmp/kes/cert/tls.crt

# KES 策略文件（policy.json）
policy:
  my-minio:
    paths:
      - /v1/key/create/minio-*
      - /v1/key/generate/minio-*
      - /v1/key/decrypt/minio-*
    identities:
      - ${MINIO_KES_IDENTITY}

# 为 MinIO 分配 KES 身份
kes identity new --key minio-identity.key --cert minio-identity.crt --ip 10.0.0.0/8 minio-access

故障现象 -> 检查集群状态 -> 定位故障节点/磁盘 -> 分析日志 -> 执行修复 -> 验证恢复
          mc admin info       mc admin heal         kubectl logs   mc admin heal     mc admin info

# 检查集群磁盘状态
mc admin info myminio

# 检查特定节点磁盘
mc admin info myminio/node-0

# 检查 Healing 状态
mc admin heal myminio

# 检查节点状态
mc admin info myminio --node

# 检查 Pod 状态
kubectl get pods -n minio -l v1.min.io/tenant=production

# 查看 Pod 日志
kubectl logs -n minio minio-pool-0-0 -c minio --tail=100

# 查看节点事件
kubectl describe pod -n minio minio-pool-0-0

# 节点网络连通性检查
mc admin info myminio --node

# DNS 解析检查
nslookup minio-pool-0-0.minio-hl.minio.svc.cluster.local

# 查看 Healing 详情
mc admin heal --recursive myminio/data-lake

# 后台 Healing 设置检查
mc admin config get myminio heal

# 强制触发 Healing
mc admin heal --recursive --force-start myminio/data-lake

# 监控 Healing 进度
watch -n 5 "mc admin heal myminio"

# 启用详细日志
mc admin config set myminio logger_webhook:debug \
  endpoint="http://log-collector:8080"

# 查看 MinIO 服务日志
kubectl logs -n minio minio-pool-0-0 -c minio | grep ERROR

# 查看审计日志
kubectl logs -n minio minio-pool-0-0 -c minio | grep Audit

# 安装 warp
wget https://github.com/minio/warp/releases/latest/download/warp_Linux_x86_64.tar.gz
tar xzf warp_Linux_x86_64.tar.gz

# GET 性能测试
warp get --host=minio.example.com:9000 --access-key=minioadmin \
  --secret-key=minioadmin --bucket=warp-bench --duration=5m \
  --obj.size=1MiB --concurrent=100

# PUT 性能测试
warp put --host=minio.example.com:9000 --access-key=minioadmin \
  --secret-key=minioadmin --bucket=warp-bench --duration=5m \
  --obj.size=1MiB --concurrent=100

# 混合负载测试（GET:PUT:DELETE:STAT = 45:40:5:10）
warp mixed --host=minio.example.com:9000 --access-key=minioadmin \
  --secret-key=minioadmin --bucket=warp-bench --duration=10m \
  --concurrent=200 --obj.size=1MiB --get-distrib=45 \
  --put-distrib=40 --delete-distrib=5 --stat-distrib=10

# 多客户端分布式测试
warp get --host=minio-{0...3}.example.com:9000 \
  --access-key=minioadmin --secret-key=minioadmin \
  --bucket=warp-bench --duration=5m --concurrent=200

# 生成 CSV 报告
warp analyze warp-get-2025-01-01.csv.gz

# 对比多次测试
warp analyze warp-get-v1.csv.gz warp-get-v2.csv.gz

# 查看详细统计
warp analyze --analyze.dur=1s warp-get-2025-01-01.csv.gz

# 安装
go install github.com/igneous-systems/s3bench@latest

# 基准测试
s3bench \
  -accessKey minioadmin \
  -accessSecret minioadmin \
  -endpoint http://minio.example.com:9000 \
  -bucket bench-bucket \
  -objectSize 1MiB \
  -numClients 128 \
  -numSamples 10000 \
  -region us-east-1

# 生成 CPU Profile
mc admin profile start myminio --type cpu

# 生成 Memory Profile
mc admin profile start myminio --type mem

# 下载 Profile 文件
mc admin profile stop myminio

# 网络延迟分析
mc admin trace myminio --filter PUT --verbose

apiVersion: minio.min.io/v2
kind: Tenant
metadata:
  name: production
  namespace: minio
spec:
  image: quay.io/minio/minio:RELEASE.2025-01-20T14-07-27Z
  imagePullPolicy: IfNotPresent
  pools:
    - name: pool-0
      servers: 4
      volumesPerServer: 4
      volumeClaimTemplate:
        spec:
          storageClassName: local-storage
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 10Ti
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      tolerations:
        - key: "node-role.min.io"
          operator: "Equal"
          value: "storage"
          effect: "NoSchedule"
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: v1.min.io/tenant
                    operator: In
                    values: ["production"]
              topologyKey: kubernetes.io/hostname
  requestAutoCert: true
  certConfig:
    commonName: "*.minio.example.com"
    organizationName: ["Company Inc"]
    dnsNames:
      - "*.minio-hl.minio.svc.cluster.local"
  users:
    - name: admin-user
  features:
    bucketDNS: false
    enableSFTP: false
  env:
    - name: MINIO_STORAGE_CLASS_STANDARD
      value: "EC:4"
    - name: MINIO_API_REQUESTS_MAX
      value: "0"

# local-storage StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-storage
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
mountOptions:
  - noatime
  - nodiratime

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
        - matchExpressions:
            - key: node-role.kubernetes.io/storage
              operator: Exists
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            v1.min.io/tenant: production
            v1.min.io/pool: pool-0
        topologyKey: kubernetes.io/hostname

spec:
  prometheusOperator: true
  metrics:
    enabled: true
    port: 9000

# 设置日志级别
mc admin config set myminio logger_webhook:stdout endpoint=""

# Kafka 审计日志
mc admin config set myminio audit_kafka:audit \
  brokers="kafka:9092" \
  topic="minio-audit" \
  queue_dir="/tmp" \
  queue_size=100000

# 每日检查
mc admin info myminio
mc admin heal myminio
mc admin scanner status myminio

# 每周检查
mc admin replicate status site-a
mc admin user list myminio
mc admin policy list myminio
mc ilm tier ls myminio

# 版本升级流程
kubectl get tenants -n minio  # 检查当前版本
kubectl edit tenant production -n minio  # 修改 image 版本
kubectl rollout status statefulset/minio-pool-0 -n minio  # 滚动更新
mc admin info myminio  # 验证集群状态