2024-01-15

CentOS7部署MinIO搭建一个属于自己的OSS

近期闲着没事就想弄个自己的OSS玩玩，搜了好久最终锁定用MinIO来部署。MinIO这东西其实跟阿里的OSS差不多，都是通过策略来控制可以做啥.

一、系统环境

1、CentOS7
2、MinIO https://min.io/
3、域名
4、S3 Driver https://www.nsoftware.com/download/

二、安装MinIO

1、下载MinIO并启动

wget https://dl.min.io/server/minio/release/linux-amd64/minio  
chmod +x minio
mkdir -p /usr/local/minio
mv minio /usr/local/minio/
cd /usr/local/minio
MINIO_ROOT_USER=minio MINIO_ROOT_PASSWORD=Aa123456* MINIO_SERVER_URL=http://abc.com:9000 MINIO_BROWSER_REDIRECT_URL=http://abc.com:8879 nohup ./minio server --address :9000 /usr/local/minio/data --console-address :8879 &

2、启动命令说明

MINIO_ROOT_USER=minio  
这个是设置minio的用户名为minio

MINIO_ROOT_PASSWORD=Aa123456*  
这个是设置minio的密码为Aa123456*

MINIO_SERVER_URL=http://abc.com:9000  
这是MinIO的API的URL，设置为http://abc.com，端口为9000  
如果没有这条，那share file的时候默认会是127.0.0.1地址，手动把这地址改掉会报跟签名不一致，所以才需要设置这个域名，这样在share file的时候就会显示域名了  

MINIO_BROWSER_REDIRECT_URL=http://abc.com:8879  
这个是重定向，当访问abc.com:9000的时候重定向到8879端口

nohup ./minio server --address :9000 /usr/local/minio/data --console-address :8879 &  
后台运行minio，避免关闭shell窗口后进程被杀  
设置minio数据存储的位置为/usr/local/minio/data  
设置minio的api端口为9000  
设置minio控制台端口为8879

3、进入minio web界面

1	启动好minio后，接下来就是打开web界面并登陆，在浏览器输入http://abc.com:8879

minio1
minio2

三、创建用户组和用户以及权限

1、创建IAM Policies，分别创建

“zwyk_writeonly”
“zwyk_readonly”
“zwyk_readwrite”
“zwyk_diagnostics”
“zwyk_consoleAdmin”
“zwyk_allowreadwrite&denycreatbacket&key”

六个IAM策略

iampolicies1
iampolicies2

zwyk_writeonly策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字，一会要创建一个叫zwyk的桶

iampolicies3

zwyk_readonly策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字，一会要创建一个叫zwyk的桶

iampolicies4

zwyk_readwrite策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字，一会要创建一个叫zwyk的桶

iampolicies5

zwyk_diagnostics策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "admin:TopLocksInfo",
                "admin:BandwidthMonitor",
                "admin:ConsoleLog",
                "admin:OBDInfo",
                "admin:Profiling",
                "admin:Prometheus",
                "admin:ServerInfo",
                "admin:ServerTrace"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字，一会要创建一个叫zwyk的桶

iampolicies6

zwyk_consoleAdmin策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "admin:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字，一会要创建一个叫zwyk的桶

iampolicies7

zwyk_allowreadwrite&denycreatbckt&key策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk/*"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字，一会要创建一个叫zwyk的桶

iampolicies8

2、创建用户组

minio3
minio4

3、创建用户

minio5
minio6
minio7

四、创建桶

minio8
minio9
minio10
minio11
minio12

zwyk桶访问策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "zwyk"
                ]
            },
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "zwyk"
                ]
            },
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:prefix": [
                        "zwyk"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "zwyk"
                ]
            },
            "Action": [
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::zwyk/*"
            ]
        }
    ]
}

//"arn:aws:s3:::zwyk"这里的zwyk是桶的名字