When navigating to MinIO > General overview in vCenter, the UI displays a '502 Bad Gateway' error

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• When navigating to Workload Management > Supervisor > Configure > MinIO > General, the UI displays a 502 Bad Gateway error.
• The minio-vsphere-plugin backend returns HTTP 502 for the /plugin.json URL.
• The masterproxy logs for the Supervisor control plane show the following error:
  # kubectl logs -l app=masterproxy -n <minio-namespace> | grep "certificate has expired"
... [error] 6#0: *67691 upstream SSL certificate verify error: (10:certificate has expired) while SSL handshaking to upstream ...
• Checking the TLS secret shows an expired certificate:
  kubectl get secret -n #### minio-plugin-tls-secret -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -text | grep After

Environment

VMware vSphere Kubernetes Service (VKS)
Supervisor Service MinIO 2.0.10

Cause

The internal TLS certificate used by the minio-vsphere-plugin has expired. This prevents the masterproxy from establishing a secure connection to the plugin backend, causing the proxy to return a 502 error.

Resolution

To resolve this issue, restart the MinIO plugin deployment to force the service to re-read and rotate the certificate.

1. Connect to the Supervisor Cluster context via kubectl.
2. Identify the MinIO namespace (typically svc-minio-domain-c##).
3. Restart the MinIO plugin deployment: kubectl rollout restart deployment -n svc-minio-domain-c## minio-vsphere
4. Verify the pods are running: kubectl get pods -n svc-minio-domain-##
5. Refresh the vSphere UI. The MinIO General tab should now load correctly.

Additional Information

• For broader certificate rotation in Supervisor Clusters, refer to KB 322994.
• To receive updates on this issue, subscribe to this article.