OIDC not working on images post RELEASE.2025-04-22T22-12-26Z

[drew-viles]

I'm trying to use chainguard iamges for Minio. They currently build based on RELEASE.2025-07-23T15-54-02Z and RELEASE.2025-09-07T16-13-09Z. For some reason, the OIDC authentication stops working once we go beyond the April builds. To make sure this wasn't an isolated issue with the Chainguard images I tried using the oddicial MinIO images instead from quay.io. I've done the same thing, just bumped the image version, but this is not functioning correctly either, I get the same issue in that OIDC is not configured on anything post April image builds.

Expected Behavior

OIDC environment variables should be honoured

Current Behavior

I'm only presented with std username/password login prompt which, when entering the admin credentials, does not give admin access. I can only see buckets as though it's a restricted user.

Possible Solution

Honestly not sure tbh.

Steps to Reproduce (for bugs)

1. Deploy minio tenant with standard image values.

          tenant:
            name: storage
            configSecret:
              name: minio-credentials
              existingSecret: true
            pools:
              - servers: 1
                name: storage-pool-0
                volumesPerServer: 1
                size: {{ .Values.minio.tenant.storageSize }}
                storageClassName: {{ .Values.storage.class }}
            metrics:
              enabled: true
            env:
              - name: MINIO_IDENTITY_OPENID_CONFIG_URL
                value: {{ printf "https://%s/application/o/minio/.well-known/openid-configuration" .Values.minio.tenant.oidcUrl }}
              - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
                value: "policy"
              - name: MINIO_IDENTITY_OPENID_SCOPES
                value: "openid,profile,email,minio"
              - name: MINIO_BROWSER_REDIRECT_URL
                value: "https://{{ .Values.minio.tenant.url }}"
              - name: MINIO_REGION
                value: "{{ .Values.region }}"

2. Now update the image value

          tenant:
            name: storage
            configSecret:
              name: minio-credentials
              existingSecret: true
            image:
              tag: RELEASE.2025-05-24T17-08-30Z
            pools:
              - servers: 1
                name: storage-pool-0
                volumesPerServer: 1
                size: {{ .Values.minio.tenant.storageSize }}
                storageClassName: {{ .Values.storage.class }}
            metrics:
              enabled: true
            env:
              - name: MINIO_IDENTITY_OPENID_CONFIG_URL
                value: {{ printf "https://%s/application/o/minio/.well-known/openid-configuration" .Values.minio.tenant.oidcUrl }}
              - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
                value: "policy"
              - name: MINIO_IDENTITY_OPENID_SCOPES
                value: "openid,profile,email,minio"
              - name: MINIO_BROWSER_REDIRECT_URL
                value: "https://{{ .Values.minio.tenant.url }}"
              - name: MINIO_REGION
                value: "{{ .Values.region }}"

Context

I cannot update the image to the latest releases bringing in the latest security patching and features as OIDC will not work and admin access seems to be restricted.

Regression

I believe this is a regression - though it could be related to the shift to AiStor? if so, might be time for me to shift away from MinIO Community ¯\(ツ)/¯
This doesn't appear to be related to the operator but the image used by the tenant.

Your Environment

• Version used (minio-operator): 7.1.1
• Environment name and version (e.g. kubernetes v1.17.2): 1.33
• Operating System and version (uname -a): Ubuntu 22.04

[drew-viles]

oh, never mind. I see what's going on here.
minio/minio#21320 (reply in thread)

Time to move away - shame.