mirror of
https://github.com/minio/docs.git
synced 2025-07-30 07:03:26 +03:00
Simplify SSE tutorials and refer to KES docs (#1136)
This PR simplifies the management of KMS integrations by removing the detailed documentation and linking out to the KES docs site instead. There should be no mention of any specific KMS target. Each OS/platform should have references to the correct paths, OS, and the like. This completes work started on the KES docs side in https://github.com/minio/kes-docs/pull/48. Staged: - [Linux](http://192.241.195.202:9000/staging/ssekms/linux/operations/server-side-encryption/configure-minio-kes.html) - [Windows](http://192.241.195.202:9000/staging/ssekms/windows/operations/server-side-encryption/configure-minio-kes.html) - [Kubernetes](http://192.241.195.202:9000/staging/ssekms/k8s/operations/server-side-encryption/configure-minio-kes.html) - [Containers](http://192.241.195.202:9000/staging/ssekms/container/operations/server-side-encryption/configure-minio-kes.html) - [MacOS](http://192.241.195.202:9000/staging/ssekms/macos/operations/server-side-encryption/configure-minio-kes.html)
This commit is contained in:
Daryl White
GitHub
@ -3,7 +3,7 @@
|
||||
The commands in this section create the following resources:
|
||||
|
||||
- A Podman :podman-docs:`Pod <markdown/podman-pod.1.html>` to facilitate container communications
|
||||
- A Container for the KES Server configured to use |rootkms| as the Root |KMS|.
|
||||
- A Container for the KES Server configured to use the chosen supported |KMS| solution.
|
||||
- A Container for a MinIO Server running in :ref:`Single-Node Single-Drive Mode <minio-snsd>`.
|
||||
|
||||
.. code-block:: shell
|
||||
@ -51,19 +51,16 @@ If all pods are operational, you can connect to the MinIO deployment by opening
|
||||
|
||||
The following commands create two TLS certificates that expire within 30 days of creation:
|
||||
|
||||
- A TLS certificate for KES to secure communications between it and the |rootkms| service.
|
||||
- A TLS certificate to secure communications between KES and the |KMS| service.
|
||||
- A TLS certificate for MinIO to perform mTLS authentication to KES.
|
||||
|
||||
.. admonition:: Use Caution in Production Environments
|
||||
:class: important
|
||||
|
||||
**DO NOT** use the TLS certificates generated as part of this procedure for
|
||||
any long-term development or production environments.
|
||||
**DO NOT** use the TLS certificates generated as part of this procedure for any long-term development or production environments.
|
||||
|
||||
Defer to organization/industry best practices around TLS certificate
|
||||
generation and management. A complete guide to creating valid certificates
|
||||
(e.g. well-formed, current, and trusted) is beyond the scope of this
|
||||
procedure.
|
||||
Defer to organization/industry best practices around TLS certificate generation and management.
|
||||
A complete guide to creating valid certificates (for example, well-formed, current, and trusted) is beyond the scope of this procedure.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
@ -111,8 +108,7 @@ This command assumes the ``minio-kes.cert``, ``minio-kes.key``, and ``kes-server
|
||||
MinIO uses the :envvar:`MINIO_KMS_KES_KEY_NAME` key for the following cryptographic operations:
|
||||
|
||||
- Encrypting the MinIO backend (IAM, configuration, etc.)
|
||||
- Encrypting objects using :ref:`SSE-KMS <minio-encryption-sse-kms>` if the request does not
|
||||
include a specific |EK|.
|
||||
- Encrypting objects using :ref:`SSE-KMS <minio-encryption-sse-kms>` if the request does not include a specific |EK|.
|
||||
- Encrypting objects using :ref:`SSE-S3 <minio-encryption-sse-s3>`.
|
||||
|
||||
MinIO uses the :envvar:`MINIO_KMS_KES_ENCLAVE` key to define the name of the KES enclave to use.
|
||||
@ -135,16 +131,13 @@ KES automatically creates this key if it does not already exist on the root KMS.
|
||||
.. admonition:: Unseal Vault Before Creating Key
|
||||
:class: important
|
||||
|
||||
You must unseal the backing Vault instance before creating new encryption keys.
|
||||
See the Vault documentation on `Seal/Unseal <https://www.vaultproject.io/docs/concepts/seal>`__ for more information.
|
||||
If required for your chosen provider, you must unseal the backing |KMS| instance before creating new encryption keys.
|
||||
Refer to the documentation for your chosen KMS solution for more information.
|
||||
|
||||
MinIO requires that the |EK| exist on the root KMS *before* performing
|
||||
|SSE| operations using that key. Use ``kes key create`` *or*
|
||||
:mc-cmd:`mc admin kms key create` to create a new |EK| for use with |SSE|.
|
||||
MinIO requires that the |EK| exist on the root KMS *before* performing |SSE| operations using that key.
|
||||
Use :kes-docs:`kes key create <cli/kes-key/create/>` *or* :mc-cmd:`mc admin kms key create` to create a new |EK| for use with |SSE|.
|
||||
|
||||
The following command uses the ``kes key create`` command to add a new
|
||||
External Key (EK) stored on the root KMS server for use with encrypting
|
||||
the MinIO backend.
|
||||
The following command uses the :kes-docs:`kes key create <cli/kes-key/create/>` command to add a new External Key (EK) stored on the root KMS server for use with encrypting the MinIO backend.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
@ -1,140 +0,0 @@
|
||||
(Podman) Deploy MinIO and KES with Server-Side Encryption using AWS Secrets Manager
|
||||
-----------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
For Windows hosts, substitute the paths with Windows-style paths, e.g. ``C:\minio-kes-vault\``.
|
||||
|
||||
|
||||
1) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
Depending on your Vault configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority. See the `Hashicorp Vault Configuration Docs <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
2) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-aws.rst
|
||||
:start-after: start-kes-configuration-aws-desc
|
||||
:end-before: end-kes-configuration-aws-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
podman run --rm \
|
||||
-v |kescertpath|/certs:/certs \
|
||||
kes:|kes-stable| tool identity of /certs/minio-kes.cert
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
podman run --rm \
|
||||
-v |kescertpath|/certs:/certs \
|
||||
kes:|kes-stable| tool identity of /certs/minio-kes.cert
|
||||
|
||||
- Replace the ``REGION`` with the appropriate region for AWS Secrets Manager.
|
||||
The value **must** match for both ``endpoint`` and ``region``.
|
||||
|
||||
- Set ``AWSACCESSKEY`` and ``AWSSECRETKEY`` to the appropriate :ref:`AWS Credentials <minio-sse-aws-prereq-aws>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
3) Create Pod and Containers
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-common-deploy-create-pod-and-containers
|
||||
:end-before: end-common-deploy-create-pod-and-containers
|
||||
|
||||
4) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
5) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You can use either the MinIO Console or the MinIO :mc:`mc` CLI to enable bucket-default SSE-KMS with the generated key:
|
||||
|
||||
.. tab-set::
|
||||
|
||||
.. tab-item:: MinIO Console
|
||||
|
||||
Open the MinIO Console by navigating to http://127.0.0.1:9001 in your preferred browser and logging in with the root credentials specified to the MinIO container.
|
||||
|
||||
Once logged in, create a new Bucket and name it to your preference.
|
||||
Select the Gear :octicon:`gear` icon to open the management view.
|
||||
|
||||
Select the pencil :octicon:`pencil` icon next to the :guilabel:`Encryption` field to open the modal for configuring a bucket default SSE scheme.
|
||||
|
||||
Select :guilabel:`SSE-KMS`, then enter the name of the key created in the previous step.
|
||||
|
||||
Once you save your changes, try to upload a file to the bucket.
|
||||
When viewing that file in the object browser, note that in the sidebar the metadata includes the SSE encryption scheme and information on the key used to encrypt that object.
|
||||
This indicates the successful encrypted state of the object.
|
||||
|
||||
.. tab-item:: MinIO CLI
|
||||
|
||||
The following commands:
|
||||
|
||||
- Create a new :ref:`alias <alias>` for the MinIO deployment
|
||||
- Create a new bucket for storing encrypted data
|
||||
- Enable SSE-KMS encryption on that bucket
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
mc alias set local http://127.0.0.1:9000 ROOTUSER ROOTPASSWORD
|
||||
|
||||
mc mb local/encryptedbucket
|
||||
mc encrypt set SSE-KMS encrypted-bucket-key ALIAS/encryptedbucket
|
||||
|
||||
Write a file to the bucket using :mc:`mc cp` or any S3-compatible SDK with a ``PutObject`` function.
|
||||
You can then run :mc:`mc stat` on the file to confirm the associated encryption metadata.
|
||||
@ -1,124 +0,0 @@
|
||||
(Podman) Deploy MinIO and KES with Server-Side Encryption using Azure Key Vault
|
||||
-------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
For Windows hosts, substitute the paths with Windows-style paths, e.g. ``C:\minio-kes-vault\``.
|
||||
|
||||
|
||||
1) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
2) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-azure.rst
|
||||
:start-after: start-kes-configuration-azure-desc
|
||||
:end-before: end-kes-configuration-azure-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
podman run --rm \
|
||||
-v |kescertpath|/certs:/certs \
|
||||
kes:|kes-stable| tool identity of /certs/minio-kes.cert
|
||||
|
||||
- Replace the ``endpoint`` with the URL for the Keyvault instance.
|
||||
|
||||
- Set ``TENANTID``, ``CLIENTID``, and ``CLIENTSECRET`` to match the credentials for a project user with the :ref:`required permissions <minio-sse-azure-prereq-azure>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
3) Create Pod and Containers
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-common-deploy-create-pod-and-containers
|
||||
:end-before: end-common-deploy-create-pod-and-containers
|
||||
|
||||
4) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
5) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You can use either the MinIO Console or the MinIO :mc:`mc` CLI to enable bucket-default SSE-KMS with the generated key:
|
||||
|
||||
.. tab-set::
|
||||
|
||||
.. tab-item:: MinIO Console
|
||||
|
||||
Open the MinIO Console by navigating to http://127.0.0.1:9001 in your preferred browser and logging in with the root credentials specified to the MinIO container.
|
||||
|
||||
Once logged in, create a new Bucket and name it to your preference.
|
||||
Select the Gear :octicon:`gear` icon to open the management view.
|
||||
|
||||
Select the pencil :octicon:`pencil` icon next to the :guilabel:`Encryption` field to open the modal for configuring a bucket default SSE scheme.
|
||||
|
||||
Select :guilabel:`SSE-KMS`, then enter the name of the key created in the previous step.
|
||||
|
||||
Once you save your changes, try to upload a file to the bucket.
|
||||
When viewing that file in the object browser, note that in the sidebar the metadata includes the SSE encryption scheme and information on the key used to encrypt that object.
|
||||
This indicates the successful encrypted state of the object.
|
||||
|
||||
.. tab-item:: MinIO CLI
|
||||
|
||||
The following commands:
|
||||
|
||||
- Create a new :ref:`alias <alias>` for the MinIO deployment
|
||||
- Create a new bucket for storing encrypted data
|
||||
- Enable SSE-KMS encryption on that bucket
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
mc alias set local http://127.0.0.1:9000 ROOTUSER ROOTPASSWORD
|
||||
|
||||
mc mb local/encryptedbucket
|
||||
mc encrypt set SSE-KMS encrypted-bucket-key ALIAS/encryptedbucket
|
||||
|
||||
Write a file to the bucket using :mc:`mc cp` or any S3-compatible SDK with a ``PutObject`` function.
|
||||
You can then run :mc:`mc stat` on the file to confirm the associated encryption metadata.
|
||||
@ -1,127 +0,0 @@
|
||||
(Podman) Deploy MinIO and KES with Server-Side Encryption using GCP Secrets Manager
|
||||
-----------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
For Windows hosts, substitute the paths with Windows-style paths, e.g. ``C:\minio-kes-vault\``.
|
||||
|
||||
|
||||
1) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
Depending on your Vault configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority. See the `Hashicorp Vault Configuration Docs <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
2) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-configuration-hashicorp-vault-desc
|
||||
:end-before: end-kes-configuration-hashicorp-vault-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
podman run --rm \
|
||||
-v |kescertpath|/certs:/certs \
|
||||
kes:|kes-stable| tool identity of /certs/minio-kes.cert
|
||||
|
||||
- Replace the ``vault.endpoint`` with the hostname of the Vault server(s).
|
||||
|
||||
- Replace the ``VAULTAPPID`` and ``VAULTAPPSECRET`` with the appropriate :ref:`Vault AppRole credentials <minio-sse-vault-prereq-vault>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create the environment file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
3) Create Pod and Containers
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-common-deploy-create-pod-and-containers
|
||||
:end-before: end-common-deploy-create-pod-and-containers
|
||||
|
||||
4) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
5) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You can use either the MinIO Console or the MinIO :mc:`mc` CLI to enable bucket-default SSE-KMS with the generated key:
|
||||
|
||||
.. tab-set::
|
||||
|
||||
.. tab-item:: MinIO Console
|
||||
|
||||
Open the MinIO Console by navigating to http://127.0.0.1:9001 in your preferred browser and logging in with the root credentials specified to the MinIO container.
|
||||
|
||||
Once logged in, create a new Bucket and name it to your preference.
|
||||
Select the Gear :octicon:`gear` icon to open the management view.
|
||||
|
||||
Select the pencil :octicon:`pencil` icon next to the :guilabel:`Encryption` field to open the modal for configuring a bucket default SSE scheme.
|
||||
|
||||
Select :guilabel:`SSE-KMS`, then enter the name of the key created in the previous step.
|
||||
|
||||
Once you save your changes, try to upload a file to the bucket.
|
||||
When viewing that file in the object browser, note that in the sidebar the metadata includes the SSE encryption scheme and information on the key used to encrypt that object.
|
||||
This indicates the successful encrypted state of the object.
|
||||
|
||||
.. tab-item:: MinIO CLI
|
||||
|
||||
The following commands:
|
||||
|
||||
- Create a new :ref:`alias <alias>` for the MinIO deployment
|
||||
- Create a new bucket for storing encrypted data
|
||||
- Enable SSE-KMS encryption on that bucket
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
mc alias set local http://127.0.0.1:9000 ROOTUSER ROOTPASSWORD
|
||||
|
||||
mc mb local/encryptedbucket
|
||||
mc encrypt set SSE-KMS encrypted-bucket-key ALIAS/encryptedbucket
|
||||
|
||||
Write a file to the bucket using :mc:`mc cp` or any S3-compatible SDK with a ``PutObject`` function.
|
||||
You can then run :mc:`mc stat` on the file to confirm the associated encryption metadata.
|
||||
@ -1,5 +1,5 @@
|
||||
(Podman) Deploy MinIO and KES with Server-Side Encryption using Hashicorp Key Vault
|
||||
-----------------------------------------------------------------------------------
|
||||
Deploy MinIO and KES with Server-Side Encryption
|
||||
------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
@ -14,17 +14,13 @@ Prior to starting these steps, create the following folders:
|
||||
For Windows hosts, substitute the paths with Windows-style paths, e.g. ``C:\minio-kes-vault\``.
|
||||
|
||||
|
||||
1) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Prerequisite
|
||||
~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
Depending on your Vault configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority. See the `Hashicorp Vault Configuration Docs <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Depending on your chosen :kes-docs:`supported KMS target <#supported-kms-targets>` configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority (CA).
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
2) Create the KES and MinIO Configurations
|
||||
1) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
@ -53,9 +49,7 @@ a. Create the KES Configuration File
|
||||
-v |kescertpath|/certs:/certs \
|
||||
kes:|kes-stable| tool identity of /certs/minio-kes.cert
|
||||
|
||||
- Replace the ``vault.endpoint`` with the hostname of the Vault server(s).
|
||||
|
||||
- Replace the ``VAULTAPPID`` and ``VAULTAPPSECRET`` with the appropriate :ref:`Vault AppRole credentials <minio-sse-vault-prereq-vault>`.
|
||||
- Refer to the instructions for setting up KES for your :kes-docs:`supported KMS solution <#kes-supported-targets>` for additional variables to define specific to your chosen KMS target.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
@ -71,21 +65,21 @@ b. Create the MinIO Environment File
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
3) Create Pod and Containers
|
||||
2) Create Pod and Containers
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-common-deploy-create-pod-and-containers
|
||||
:end-before: end-common-deploy-create-pod-and-containers
|
||||
|
||||
4) Generate a New Encryption Key
|
||||
3) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/container/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
5) Enable SSE-KMS for a Bucket
|
||||
4) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You can use either the MinIO Console or the MinIO :mc:`mc` CLI to enable bucket-default SSE-KMS with the generated key:
|
||||
|
||||
Reference in New Issue
Block a user