mirror of
https://github.com/minio/docs.git
synced 2025-07-31 18:04:52 +03:00
Completion of SSE-KMS doc rewrite (#539)
This commit is contained in:
Ravind Kumar
GitHub
@ -11,8 +11,8 @@ The following example code downloads the latest Linux AMD64-compatible binary an
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
wget https://github.com/minio/kes/releases/download/v|kes-stable|/kes-linux-amd64 -O /tmp/kes && \
|
||||
chmod +x /tmp/kes && \
|
||||
wget https://github.com/minio/kes/releases/download/|kes-stable|/kes-linux-amd64 -O /tmp/kes
|
||||
chmod +x /tmp/kes
|
||||
sudo mv /tmp/kes /usr/local/bin
|
||||
|
||||
kes --version
|
||||
@ -24,7 +24,7 @@ MinIO strongly recommends configuring a load balancer with a "Least Connections"
|
||||
|
||||
.. start-kes-service-file-desc
|
||||
|
||||
Create the ``/etc/systemd/system/minio.service`` file on all KES hosts:
|
||||
Create the ``/etc/systemd/system/kes.service`` file on all KES hosts:
|
||||
|
||||
.. literalinclude:: /extra/kes.service
|
||||
:language: shell
|
||||
@ -42,6 +42,15 @@ These commands typically require root (``sudo``) permissions.
|
||||
groupadd -r kes-user
|
||||
useradd -M -r -g kes-user kes-user
|
||||
|
||||
The ``kes-user`` user and group must have read access to all files used by the KES service:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
chown -R kes-user:kes-user /opt/kes
|
||||
chown -R kes-user:kes-user /etc/kes
|
||||
|
||||
.. end-kes-service-file-desc
|
||||
|
||||
.. start-kes-start-service-desc
|
||||
@ -75,4 +84,90 @@ For existing MinIO deployments, run the following command on each MinIO host to
|
||||
systemctl reload minio
|
||||
systemctl restart minio
|
||||
|
||||
.. end-kes-minio-start-service-desc
|
||||
.. end-kes-minio-start-service-desc
|
||||
|
||||
.. start-kes-generate-kes-certs-prod-desc
|
||||
|
||||
Enabling connectivity between MinIO and KES requires at minimum one TLS certificate for performing mutual TLS (mTLS) authentication.
|
||||
Depending on your Vault configuration, you may also need to create a dedicated set of TLS certificates for KES to connect and authenticate to Vault.
|
||||
Defer to your organizations best practices around generating production-ready TLS certificates.
|
||||
|
||||
Place the certificates and corresponding private keys an appropriate directory such that the MinIO and KES service users can access and read their contents.
|
||||
This procedure assumes a structure similar to the following:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
# For the MinIO Hosts
|
||||
-rw-r--r-- 1 minio-user:minio-user |miniocertpath|/minio-kes.cert
|
||||
-rw-r--r-- 1 minio-user:minio-user |miniocertpath|/minio-kes.key
|
||||
|
||||
# If KES certs are self-signed or use a non-global CA
|
||||
# Include the CA certs as well
|
||||
-rw-r--r-- 1 minio-user:minio-user |miniocertpath|/kes-server.cert
|
||||
|
||||
# For the KES Hosts
|
||||
-rw-r--r-- 1 kes-user:kes-user |kescertpath|/kes-server.cert
|
||||
-rw-r--r-- 1 kes-user:kes-user |kescertpath|/kes-server.key
|
||||
|
||||
If the KES certificates are self-signed *or* signed by Certificate Authority (CA) that is *not* globally trusted, you **must** add the CA certificate to the |miniocertpath|/certs directory such that each MinIO server can properly validate the KES certificates.
|
||||
|
||||
.. end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
.. start-kes-configuration-minio-desc
|
||||
|
||||
Add the following lines to the MinIO Environment file on each MinIO host.
|
||||
See the tutorials for :ref:`minio-snsd`, :ref:`minio-snmd`, or :ref:`minio-mnmd` for more detailed descriptions of a base MinIO environment file.
|
||||
|
||||
This command assumes the ``minio-kes.cert``, ``minio-kes.key``, and ``kes-server.cert`` certificates are accessible at the specified location:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
# Add these environment variables to the existing environment file
|
||||
|
||||
MINIO_KMS_KES_ENDPOINT=https://HOSTNAME:7373
|
||||
MINIO_KMS_KES_CERT_FILE=|miniocertpath|/minio-kes.cert
|
||||
MINIO_KMS_KES_KEY_FILE=|miniocertpath|/minio-kes.key
|
||||
MINIO_KMS_KES_CAPATH=|kescertpath|/kes-server.cert
|
||||
MINIO_KMS_KES_KEY_NAME=minio-backend-default-key
|
||||
|
||||
minio server [ARGUMENTS]
|
||||
|
||||
Replace ``HOSTNAME`` with the IP address or hostname of the KES server.
|
||||
If the MinIO server host machines cannot resolve or reach the specified ``HOSTNAME``, the deployment may return errors or fail to start.
|
||||
|
||||
- If using a single KES server host, specify the IP or hostname of that host
|
||||
- If using multiple KES server hosts, specify the load balancer or reverse proxy managing connections to those hosts.
|
||||
|
||||
MinIO uses the :envvar:`MINIO_KMS_KES_KEY_NAME` key for the following cryptographic operations:
|
||||
|
||||
- Encrypting the MinIO backend (IAM, configuration, etc.)
|
||||
- Encrypting objects using :ref:`SSE-KMS <minio-encryption-sse-kms>` if the request does not
|
||||
include a specific |EK|.
|
||||
- Encrypting objects using :ref:`SSE-S3 <minio-encryption-sse-s3>`.
|
||||
|
||||
The ``minio-kes`` certificates enable mTLS between the MinIO deployment and the KES server *only*.
|
||||
They do not otherwise enable TLS for other client connections to MinIO.
|
||||
|
||||
.. end-kes-configuration-minio-desc
|
||||
|
||||
.. start-kes-generate-key-desc
|
||||
|
||||
MinIO requires that the |EK| exist on the root KMS *before* performing |SSE| operations using that key.
|
||||
Use ``kes key create`` *or* :mc:`mc admin kms key create` to add a new |EK| for use with |SSE|.
|
||||
|
||||
The following command uses the ``kes key create`` command to add a new External Key (EK) stored on the root KMS server for use with encrypting the MinIO backend.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
export KES_SERVER=https://127.0.0.1:7373
|
||||
export KES_CLIENT_KEY=|miniocertpath|/minio-kes.key
|
||||
export KES_CLIENT_CERT=|miniocertpath|/minio-kes.cert
|
||||
|
||||
kes key create -k encrypted-bucket-key
|
||||
|
||||
.. end-kes-generate-key-desc
|
||||
110
source/includes/linux/steps-configure-minio-kes-aws-quick.rst
Normal file
110
source/includes/linux/steps-configure-minio-kes-aws-quick.rst
Normal file
@ -0,0 +1,110 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using AWS Secrets Manager for Local Development
|
||||
------------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-aws.rst
|
||||
:start-after: start-kes-configuration-aws-desc
|
||||
:end-before: end-kes-configuration-aws-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``REGION`` with the appropriate region for AWS Secrets Manager.
|
||||
The value **must** match for both ``endpoint`` and ``region``.
|
||||
|
||||
- Set ``AWSACCESSKEY`` and ``AWSSECRETKEY`` to the appropriate :ref:`AWS Credentials <minio-sse-aws-prereq-aws>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
111
source/includes/linux/steps-configure-minio-kes-aws.rst
Normal file
111
source/includes/linux/steps-configure-minio-kes-aws.rst
Normal file
@ -0,0 +1,111 @@
|
||||
Enable Server-Side Encryption with AWS SecretsManager for Production
|
||||
--------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-aws.rst
|
||||
:start-after: start-kes-configuration-aws-desc
|
||||
:end-before: end-kes-configuration-aws-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``REGION`` with the appropriate region for AWS Secrets Manager.
|
||||
The value **must** match for both ``endpoint`` and ``region``.
|
||||
|
||||
- Set ``AWSACCESSKEY`` and ``AWSSECRETKEY`` to the appropriate :ref:`AWS Credentials <minio-sse-aws-prereq-aws>`.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
109
source/includes/linux/steps-configure-minio-kes-azure-quick.rst
Normal file
109
source/includes/linux/steps-configure-minio-kes-azure-quick.rst
Normal file
@ -0,0 +1,109 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using Azure Key Vault for Local Development
|
||||
--------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-azure.rst
|
||||
:start-after: start-kes-configuration-azure-desc
|
||||
:end-before: end-kes-configuration-azure-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``endpoint`` with the URL for the Keyvault instance.
|
||||
|
||||
- Set ``TENANTID``, ``CLIENTID``, and ``CLIENTSECRET`` to match the credentials for a project user with the :ref:`required permissions <minio-sse-azure-prereq-azure>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
110
source/includes/linux/steps-configure-minio-kes-azure.rst
Normal file
110
source/includes/linux/steps-configure-minio-kes-azure.rst
Normal file
@ -0,0 +1,110 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using Azure KeyVault for Local Development
|
||||
--------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-azure.rst
|
||||
:start-after: start-kes-configuration-azure-desc
|
||||
:end-before: end-kes-configuration-azure-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``endpoint`` with the URL for the Keyvault instance.
|
||||
|
||||
- Set ``TENANTID``, ``CLIENTID``, and ``CLIENTSECRET`` to match the credentials for a project user with the :ref:`required permissions <minio-sse-azure-prereq-azure>`.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
109
source/includes/linux/steps-configure-minio-kes-gcp-quick.rst
Normal file
109
source/includes/linux/steps-configure-minio-kes-gcp-quick.rst
Normal file
@ -0,0 +1,109 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using GCP Secrets Manager for Local Development
|
||||
------------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-gcp.rst
|
||||
:start-after: start-kes-configuration-gcp-desc
|
||||
:end-before: end-kes-configuration-gcp-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Set ``GCPPROJECTID`` to the GCP project for the Secrets Manager instance KES should use.
|
||||
|
||||
- Set ``GCPCLIENTEMAIL``, ``GCPCLIENTID``, ``GCPPRIVATEKEYID``, and ``GCPPRIVATEKEY`` to the credentials associated to the :ref:`GCP Service Account <minio-sse-gcp-prereq-gcp>` KES should use when accessing the Secrets Manager service.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
110
source/includes/linux/steps-configure-minio-kes-gcp.rst
Normal file
110
source/includes/linux/steps-configure-minio-kes-gcp.rst
Normal file
@ -0,0 +1,110 @@
|
||||
Enable Server-Side Encryption with GCP Secrets Manager for Production
|
||||
---------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-gcp.rst
|
||||
:start-after: start-kes-configuration-gcp-desc
|
||||
:end-before: end-kes-configuration-gcp-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Set ``GCPPROJECTID`` to the GCP project for the Secrets Manager instance KES should use.
|
||||
|
||||
- Set ``GCPCLIENTEMAIL``, ``GCPCLIENTID``, ``GCPPRIVATEKEYID``, and ``GCPPRIVATEKEY`` to the credentials associated to the :ref:`GCP Service Account <minio-sse-gcp-prereq-gcp>` KES should use when accessing the Secrets Manager service.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -0,0 +1,113 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using Hashicorp Vault for Local Development
|
||||
--------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
Depending on your Vault configuration, you may need to pass the ``kes-server.cert`` certificate as a trusted Certificate Authority.
|
||||
See the `Hashicorp Server Configuration Documentation <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-configuration-hashicorp-vault-desc
|
||||
:end-before: end-kes-configuration-hashicorp-vault-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``vault.endpoint`` with the hostname of the Vault server(s).
|
||||
|
||||
- Replace the ``VAULTAPPID`` and ``VAULTAPPSECRET`` with the appropriate :ref:`Vault AppRole credentials <minio-sse-vault-prereq-vault>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,53 +1,15 @@
|
||||
This procedure assumes a single local host machine running the MinIO and KES processes.
|
||||
As part of this procedure, you will:
|
||||
Deploy MinIO and KES with Server-Side Encryption using Hashicorp Vault for Production
|
||||
-------------------------------------------------------------------------------------
|
||||
|
||||
- Deploy a |KES| server configured to use `Hashicorp Vault <https://www.vaultproject.io/>`__ as the root |KMS|.
|
||||
|
||||
- Create a new |EK| on Vault for use with |SSE|.
|
||||
|
||||
- Deploy a MinIO server configured to use the |KES| container for supporting |SSE|.
|
||||
|
||||
- Configure automatic bucket-default :ref:`SSE-KMS <minio-encryption-sse-kms>`.
|
||||
|
||||
For production environments, this procedure provides general guidance on deploying and configuring KES at scale.
|
||||
Defer to the :ref:`Deploy Distributed MinIO <minio-mnmd>` tutorial for guidance on production-ready MinIO deployments.
|
||||
|
||||
For production orchestrated environments, use the MinIO Kubernetes Operator to deploy a tenant with |SSE| enabled and configured for use with Hashicorp Vault.
|
||||
|
||||
.. important::
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-encrypted-backend-desc
|
||||
:end-before: end-kes-encrypted-backend-desc
|
||||
|
||||
Prerequisites
|
||||
-------------
|
||||
|
||||
.. _minio-sse-vault-prereq-vault:
|
||||
|
||||
Deploy or Ensure Access to a Hashicorp Vault Service
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-prereq-hashicorp-vault-desc
|
||||
:end-before: end-kes-prereq-hashicorp-vault-desc
|
||||
|
||||
Deploy or Ensure Access to a MinIO Deployment
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-new-existing-minio-deployment-desc
|
||||
:end-before: end-kes-new-existing-minio-deployment-desc
|
||||
|
||||
Deploy MinIO and KES to Enable Server-Side Encryption with Hashicorp Vault
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P ~/minio-kes-vault/certs ~/minio-kes-vault/minio ~/minio-kes-vault/config
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
@ -67,38 +29,53 @@ b. Create the Service File
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
Depending on your Vault configuration, you may also need to specify the CA used to sign the KES certificates to the Vault server.
|
||||
See the `Hashicorp Vault Configuration Docs <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-configuration-hashicorp-vault-desc
|
||||
:end-before: end-kes-configuration-hashicorp-vault-desc
|
||||
|
||||
Save the configuration file as ``~/minio-kes-vault/config/kes-config.yaml``.
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of ~/minio-kes-vault/certs/minio-kes.cert
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``vault.endpoint`` with the hostname of the Vault server(s).
|
||||
|
||||
- Replace the ``VAULTAPPID`` and ``VAULTAPPSECRET`` with the appropriate :ref:`Vault AppRole credentials <minio-sse-vault-prereq-vault>`.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
@ -108,7 +85,9 @@ b. Create the MinIO Environment File
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
@ -123,7 +102,7 @@ b. Start the MinIO Server
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
|
||||
Reference in New Issue
Block a user