mirror of
https://github.com/minio/docs.git
synced 2025-07-30 07:03:26 +03:00
Completion of SSE-KMS doc rewrite (#539)
This commit is contained in:
Ravind Kumar
GitHub
@ -13,7 +13,7 @@ The command downloads the |kes-stable| binary for that architecture, sets it to
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
curl -O https://github.com/minio/kes/releases/download/v|kes-stable|/kes-darwin-arm64
|
||||
curl -O https://github.com/minio/kes/releases/download/|kes-stable|/kes-darwin-arm64
|
||||
chmod +x ./kes-darwin-arm64
|
||||
sudo mv ./kes-darwin-arm64 /usr/local/bin/kes
|
||||
|
||||
@ -23,34 +23,9 @@ The command downloads the |kes-stable| binary for that architecture, sets it to
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
curl -O https://github.com/minio/kes/releases/download/v|kes-stable|/kes-darwin-amd64
|
||||
curl -O https://github.com/minio/kes/releases/download/|kes-stable|/kes-darwin-amd64
|
||||
chmod +x ./kes-darwin-amd64
|
||||
sudo mv ./kes-darwin-amd64 /usr/local/bin/kes
|
||||
|
||||
.. end-kes-download-desc
|
||||
|
||||
.. start-kes-start-server-desc
|
||||
|
||||
Run the following command in a terminal or shell to start the KES server as a foreground process.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
kes server --mlock --auth --config=~/minio-kes-vault/kes-server-config.yaml
|
||||
|
||||
Defer to the documentation for your MacOS Operating System version for instructions on running a process in the background.
|
||||
|
||||
.. end-kes-start-server-desc
|
||||
|
||||
.. start-kes-minio-start-server-desc
|
||||
|
||||
Run the following command in a terminal or shell to start the MinIO server as a foreground process.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
export MINIO_CONFIG_ENV_FILE=/etc/default/minio
|
||||
minio server --console-address :9090
|
||||
|
||||
.. end-kes-minio-start-server-desc
|
||||
|
||||
|
||||
108
source/includes/macos/steps-configure-minio-kes-aws.rst
Normal file
108
source/includes/macos/steps-configure-minio-kes-aws.rst
Normal file
@ -0,0 +1,108 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using AWS Secrets Manager
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/macos/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-aws.rst
|
||||
:start-after: start-kes-configuration-aws-desc
|
||||
:end-before: end-kes-configuration-aws-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``REGION`` with the appropriate region for AWS Secrets Manager.
|
||||
The value **must** match for both ``endpoint`` and ``region``.
|
||||
|
||||
- Set ``AWSACCESSKEY`` and ``AWSSECRETKEY`` to the appropriate :ref:`AWS Credentials <minio-sse-aws-prereq-aws>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
107
source/includes/macos/steps-configure-minio-kes-azure.rst
Normal file
107
source/includes/macos/steps-configure-minio-kes-azure.rst
Normal file
@ -0,0 +1,107 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using Azure Key Vault
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/macos/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-azure.rst
|
||||
:start-after: start-kes-configuration-azure-desc
|
||||
:end-before: end-kes-configuration-azure-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``endpoint`` with the URL for the Keyvault instance.
|
||||
|
||||
- Set ``TENANTID``, ``CLIENTID``, and ``CLIENTSECRET`` to match the credentials for a project user with the :ref:`required permissions <minio-sse-azure-prereq-azure>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
107
source/includes/macos/steps-configure-minio-kes-gcp.rst
Normal file
107
source/includes/macos/steps-configure-minio-kes-gcp.rst
Normal file
@ -0,0 +1,107 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using GCP Secrets Manager
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/macos/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-gcp.rst
|
||||
:start-after: start-kes-configuration-gcp-desc
|
||||
:end-before: end-kes-configuration-gcp-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Set ``GCPPROJECTID`` to the GCP project for the Secrets Manager instance KES should use.
|
||||
|
||||
- Set ``GCPCLIENTEMAIL``, ``GCPCLIENTID``, ``GCPPRIVATEKEYID``, and ``GCPPRIVATEKEY`` to the credentials associated to the :ref:`GCP Service Account <minio-sse-gcp-prereq-gcp>` KES should use when accessing the Secrets Manager service.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,56 +1,18 @@
|
||||
This procedure assumes a single local host machine running the MinIO and KES processes.
|
||||
As part of this procedure, you will:
|
||||
|
||||
- Deploy a |KES| server configured to use `Hashicorp Vault <https://www.vaultproject.io/>`__ as the root |KMS|.
|
||||
|
||||
- Create a new |EK| on Vault for use with |SSE|.
|
||||
|
||||
- Deploy a MinIO server configured to use the |KES| container for supporting |SSE|.
|
||||
|
||||
- Configure automatic bucket-default :ref:`SSE-KMS <minio-encryption-sse-kms>`.
|
||||
|
||||
For production environments, MinIO recommends using Linux hosts.
|
||||
See the MinIO on Linux documentation for configuring MinIO with KES and Hashicorp Vault.
|
||||
|
||||
For production orchestrated environments, use the MinIO Kubernetes Operator to deploy a tenant with |SSE| enabled and configured for use with Hashicorp Vault.
|
||||
|
||||
.. important::
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-encrypted-backend-desc
|
||||
:end-before: end-kes-encrypted-backend-desc
|
||||
|
||||
Prerequisites
|
||||
-------------
|
||||
|
||||
.. _minio-sse-vault-prereq-vault:
|
||||
|
||||
Deploy or Ensure Access to a Hashicorp Vault Service
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-prereq-hashicorp-vault-desc
|
||||
:end-before: end-kes-prereq-hashicorp-vault-desc
|
||||
|
||||
Deploy or Ensure Access to a MinIO Deployment
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-new-existing-minio-deployment
|
||||
:end-before: end-kes-new-existing-minio-deployment
|
||||
|
||||
Deploy MinIO and KES to Enable Server-Side Encryption with Hashicorp Vault
|
||||
--------------------------------------------------------------------------
|
||||
Deploy MinIO and KES with Server-Side Encryption using Hashicorp Vault
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P ~/minio-kes-vault/certs ~/minio-kes-vault/minio ~/minio-kes-vault/config
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
1) Download the KES Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/macos/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
@ -63,33 +25,50 @@ Prior to starting these steps, create the following folders:
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
Depending on your Vault configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority. See the `Hashicorp Vault Configuration Docs <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-configuration-hashicorp-vault-desc
|
||||
:end-before: end-kes-configuration-hashicorp-vault-desc
|
||||
|
||||
Save the configuration file as ``~/minio-kes-vault/config/kes-config.yaml``.
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes tool identity of ~/minio-kes-vault/certs/minio-kes.cert
|
||||
kes tool identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``vault.endpoint`` with the hostname of the Vault server(s).
|
||||
|
||||
- Replace the ``VAULTAPPID`` and ``VAULTAPPSECRET`` with the appropriate :ref:`Vault AppRole credentials <minio-sse-vault-prereq-vault>`.
|
||||
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
@ -102,16 +81,20 @@ The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/macos/common-minio-kes.rst
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/macos/common-minio-kes.rst
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
||||
Reference in New Issue
Block a user