现场

为了减少后端转发用户上传文件到 Minio 这一不必要的操作，我们选择了 Minio 签名直传的方式提高性能、减少资源浪费。项目上线后发现无法正常上传文件，出现了 CORS 问题，而 Minio 本身无法提供跨域支持。目前唯一的解决方案是我们手动添加 Header 头。

网上没啥有用的教程，有个教程也是用的 Nginx，所以我把解决方案随手记录一下：

Access to fetch at 'https://minio.storage.liusuyun.com/user/avatar/a3c8b239f5894f109173346c0ea2aafd?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=admin%2F20220506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220506T092149Z&X-Amz-Expires=604&X-Amz-SignedHeaders=host&X-Amz-Signature=f585fe18167ef6cbe21fe59deb959f5182809564128d652a1f2a0621c70105fd' from origin 'http://passport.liusuyun.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

PUT http://minio.storage.liusuyun.com/user/avatar/a3c8b239f5894f109173346c0ea2aafd?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=admin%2F20220506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220506T092149Z&X-Amz-Expires=604&X-Amz-SignedHeaders=host&X-Amz-Signature=f585fe18167ef6cbe21fe59deb959f5182809564128d652a1f2a0621c70105fd net::ERR_FAILED

解决方案

使用 Traefik Middleware

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: minio
  namespace: storage
spec:
  headers:
    customResponseHeaders: 
      Access-Control-Allow-Origin: "*"
      Access-Control-Allow-Credentials: "*"
      Access-Control-Allow-Methods: "*"
      Access-Control-Allow-Headers: "*"

与 Ingress 绑定只需要：

kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: minio
  namespace: storage
  annotations:
    kubesphere.io/creator: ying
    traefik.ingress.kubernetes.io/router.middlewares: storage-minio@kubernetescrd
spec:
  rules:
    - host: minio.storage.liusuyun.com
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: cake-minio
                port:
                  number: 9001
    - host: oss.storage.liusuyun.com
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: cake-minio
                port:
                  number: 9000

其中最关键的是：

traefik.ingress.kubernetes.io/router.middlewares: storage-minio@kubernetescrd

这句话的格式是：

traefik.ingress.kubernetes.io/router.middlewares: 命名空间-中间件名称@kubernetescrd

撒花~