// the find
minio/operator
Simple Kubernetes Operator for MinIO clusters :computer:
The MinIO Operator is a Kubernetes controller that manages MinIO object storage tenants as custom resources. It handles the full lifecycle — provisioning, TLS, scaling, and KES encryption integration — for teams that want S3-compatible storage running inside their own cluster rather than paying for managed object storage.
The multi-tenant model is well thought out: each Tenant CR gets its own namespace, independent scaling, and isolated credentials, so you can run dev/staging/prod on the same cluster without them bleeding into each other. TLS is on by default and wired through the Kubernetes certificates API, which means you're not bolting security on after the fact. The KES integration for envelope encryption (Vault, GCP KMS) is production-grade and documented with real examples. The kustomize-first install story is clean — no Helm required to get something running, and the examples directory covers a surprising range of real configurations.
The one-tenant-per-namespace constraint is a hard architectural limit that will frustrate anyone running many small tenants — you end up with namespace sprawl and separate RBAC headaches per tenant. The AGPL v3 license is a business risk that many legal teams will flag immediately; if you're building a product that ships this as a dependency, get your lawyers involved before you're in too deep. The README punts almost everything to external docs, so the getting-started experience is worse than it looks — you discover mid-way that you also need DirectPV installed and a custom StorageClass configured before anything actually works. Upgrade path documentation exists (UPGRADE.md) but the breaking changes between major versions (v5 → v6 → v7) have historically been significant, and the operator does not support in-place downgrade if something goes wrong.