mirror of
https://github.com/minio/docs.git
synced 2025-07-30 07:03:26 +03:00
Simplify SSE tutorials and refer to KES docs (#1136)
This PR simplifies the management of KMS integrations by removing the detailed documentation and linking out to the KES docs site instead. There should be no mention of any specific KMS target. Each OS/platform should have references to the correct paths, OS, and the like. This completes work started on the KES docs side in https://github.com/minio/kes-docs/pull/48. Staged: - [Linux](http://192.241.195.202:9000/staging/ssekms/linux/operations/server-side-encryption/configure-minio-kes.html) - [Windows](http://192.241.195.202:9000/staging/ssekms/windows/operations/server-side-encryption/configure-minio-kes.html) - [Kubernetes](http://192.241.195.202:9000/staging/ssekms/k8s/operations/server-side-encryption/configure-minio-kes.html) - [Containers](http://192.241.195.202:9000/staging/ssekms/container/operations/server-side-encryption/configure-minio-kes.html) - [MacOS](http://192.241.195.202:9000/staging/ssekms/macos/operations/server-side-encryption/configure-minio-kes.html)
This commit is contained in:
Daryl White
GitHub
@ -1,71 +1,3 @@
|
||||
.. start-kes-download-desc
|
||||
|
||||
Download the latest stable release (|kes-stable|) of KES from :minio-git:`github.com/minio/kes <kes/releases/latest>`.
|
||||
|
||||
Select the binary appropriate for the host OS architecture.
|
||||
For example, hosts running X86-64 (Intel/AMD64) should download the ``kes-linux-amd64`` package.
|
||||
|
||||
The following example code downloads the latest Linux AMD64-compatible binary and moves it to the system ``PATH``:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
curl --retry 10 https://github.com/minio/kes/releases/download/|kes-stable|/kes-linux-amd64 -o /tmp/kes
|
||||
chmod +x /tmp/kes
|
||||
sudo mv /tmp/kes /usr/local/bin
|
||||
|
||||
kes --version
|
||||
|
||||
For distributed KES topologies, repeat this step and all following KES-specific instructions for each host on which you want to deploy KES.
|
||||
MinIO uses a round-robin approach by default for routing connections to multiple configured KES servers.
|
||||
For more granular controls, deploy a dedicated load balancer to manage connections to distributed KES hosts.
|
||||
|
||||
.. end-kes-download-desc
|
||||
|
||||
.. start-kes-service-file-desc
|
||||
|
||||
Create the ``/lib/systemd/system/kes.service`` file on all KES hosts:
|
||||
|
||||
.. literalinclude:: /extra/kes.service
|
||||
:language: shell
|
||||
|
||||
You may need to run ``systemctl daemon-reload`` to load the new service file into ``systemctl``.
|
||||
|
||||
The ``kes.service`` file runs as the ``kes`` User and Group by default.
|
||||
You can create the user and group using the ``useradd`` and ``groupadd`` commands.
|
||||
The following example creates the user and group.
|
||||
These commands typically require root (``sudo``) permissions.
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
groupadd -r kes
|
||||
useradd -M -r -g kes kes
|
||||
|
||||
The ``kes`` user and group must have read access to all files used by the KES service:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
chown -R kes:kes /opt/kes
|
||||
|
||||
.. end-kes-service-file-desc
|
||||
|
||||
.. start-kes-start-service-desc
|
||||
|
||||
Run the following command on each KES host to start the service:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
|
||||
systemctl start kes
|
||||
|
||||
You can validate the startup by using ``systemctl status kes``.
|
||||
If the service started successfully, use ``journalctl -uf kes`` to check the KES output logs.
|
||||
|
||||
.. end-kes-start-service-desc
|
||||
|
||||
.. start-kes-minio-start-service-desc
|
||||
|
||||
@ -91,7 +23,7 @@ For existing MinIO deployments, run the following command on each MinIO host to
|
||||
KES requires TLS connectivity for all client connections, including those originating from MinIO.
|
||||
See :ref:`minio-tls` for more information on enabling TLS for the MinIO deployment.
|
||||
|
||||
Depending on your Vault configuration, you may also need to create a dedicated set of TLS certificates for KES to connect and authenticate to Vault.
|
||||
Depending on your selected KMS target's configuration, you may also need to create a dedicated set of TLS certificates for KES to connect and authenticate to the KMS.
|
||||
|
||||
Defer to your organization's best practices around generating production-ready TLS certificates.
|
||||
|
||||
|
||||
@ -1,110 +0,0 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using AWS Secrets Manager for Local Development
|
||||
------------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-aws.rst
|
||||
:start-after: start-kes-configuration-aws-desc
|
||||
:end-before: end-kes-configuration-aws-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``REGION`` with the appropriate region for AWS Secrets Manager.
|
||||
The value **must** match for both ``endpoint`` and ``region``.
|
||||
|
||||
- Set ``AWSACCESSKEY`` and ``AWSSECRETKEY`` to the appropriate :ref:`AWS Credentials <minio-sse-aws-prereq-aws>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,116 +0,0 @@
|
||||
Enable Server-Side Encryption with AWS SecretsManager for Production
|
||||
--------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. important::
|
||||
|
||||
Starting with :minio-release:`RELEASE.2023-02-17T17-52-43Z`, MinIO requires expanded KES permissions for functionality.
|
||||
The example configuration in this section contains all required permissions.
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-aws.rst
|
||||
:start-after: start-kes-configuration-aws-desc
|
||||
:end-before: end-kes-configuration-aws-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``REGION`` with the appropriate region for AWS Secrets Manager.
|
||||
The value **must** match for both ``endpoint`` and ``region``.
|
||||
|
||||
- Set ``AWSACCESSKEY`` and ``AWSSECRETKEY`` to the appropriate :ref:`AWS Credentials <minio-sse-aws-prereq-aws>`.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,109 +0,0 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using Azure Key Vault for Local Development
|
||||
--------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-azure.rst
|
||||
:start-after: start-kes-configuration-azure-desc
|
||||
:end-before: end-kes-configuration-azure-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``endpoint`` with the URL for the Keyvault instance.
|
||||
|
||||
- Set ``TENANTID``, ``CLIENTID``, and ``CLIENTSECRET`` to match the credentials for a project user with the :ref:`required permissions <minio-sse-azure-prereq-azure>`.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,115 +0,0 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using Azure KeyVault for Production
|
||||
------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. important::
|
||||
|
||||
Starting with :minio-release:`RELEASE.2023-02-17T17-52-43Z`, MinIO requires expanded KES permissions for functionality.
|
||||
The example configuration in this section contains all required permissions.
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-azure.rst
|
||||
:start-after: start-kes-configuration-azure-desc
|
||||
:end-before: end-kes-configuration-azure-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Replace the ``endpoint`` with the URL for the Keyvault instance.
|
||||
|
||||
- Set ``TENANTID``, ``CLIENTID``, and ``CLIENTSECRET`` to match the credentials for a project user with the :ref:`required permissions <minio-sse-azure-prereq-azure>`.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,109 +0,0 @@
|
||||
Deploy MinIO and KES with Server-Side Encryption using GCP Secrets Manager for Local Development
|
||||
------------------------------------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
mkdir -P |minioconfigpath|
|
||||
mkdir -P |miniodatapath|
|
||||
|
||||
1) Download the KES Server Binary
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-desc
|
||||
:end-before: end-kes-generate-kes-certs-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |kesconfigpath|/kes-config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-gcp.rst
|
||||
:start-after: start-kes-configuration-gcp-desc
|
||||
:end-before: end-kes-configuration-gcp-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Set ``GCPPROJECTID`` to the GCP project for the Secrets Manager instance KES should use.
|
||||
|
||||
- Set ``GCPCLIENTEMAIL``, ``GCPCLIENTID``, ``GCPPRIVATEKEYID``, and ``GCPPRIVATEKEY`` to the credentials associated to the :ref:`GCP Service Account <minio-sse-gcp-prereq-gcp>` KES should use when accessing the Secrets Manager service.
|
||||
|
||||
b. Create the MinIO Environment File
|
||||
|
||||
Create or modify the environment file for the MinIO deployment using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano |minioconfigpath|/minio
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
a. Start the KES Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-start-server-desc
|
||||
:end-before: end-kes-start-server-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-server-desc
|
||||
:end-before: end-kes-minio-start-server-desc
|
||||
|
||||
Foreground processes depend on the shell or terminal in which they run.
|
||||
Exiting or terminating the shell/terminal instance also kills the attached process.
|
||||
Defer to your operating system best practices for running processes in the background.
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,115 +0,0 @@
|
||||
Enable Server-Side Encryption with GCP Secrets Manager for Production
|
||||
---------------------------------------------------------------------
|
||||
|
||||
Prior to starting these steps, create the following folders if they do not already exist:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
mkdir -P |kescertpath|
|
||||
mkdir -P |kesconfigpath|
|
||||
mkdir -P |miniocertpath|
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. important::
|
||||
|
||||
Starting with :minio-release:`RELEASE.2023-02-17T17-52-43Z`, MinIO requires expanded KES permissions for functionality.
|
||||
The example configuration in this section contains all required permissions.
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
3) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
a. Create the KES Configuration File
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
|
||||
nano /etc/kes/config.yaml
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-gcp.rst
|
||||
:start-after: start-kes-configuration-gcp-desc
|
||||
:end-before: end-kes-configuration-gcp-desc
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the MinIO mTLS certificate.
|
||||
|
||||
The following command computes the necessary hash:
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
:substitutions:
|
||||
|
||||
kes identity of |miniocertpath|/minio-kes.cert
|
||||
|
||||
- Set ``GCPPROJECTID`` to the GCP project for the Secrets Manager instance KES should use.
|
||||
|
||||
- Set ``GCPCLIENTEMAIL``, ``GCPCLIENTID``, ``GCPPRIVATEKEYID``, and ``GCPPRIVATEKEY`` to the credentials associated to the :ref:`GCP Service Account <minio-sse-gcp-prereq-gcp>` KES should use when accessing the Secrets Manager service.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables.
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
4) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-enable-sse-kms-desc
|
||||
:end-before: end-kes-enable-sse-kms-desc
|
||||
@ -1,42 +1,20 @@
|
||||
Procedure
|
||||
---------
|
||||
|
||||
This procedure provides instructions for configuring and enabling Server-Side Encryption using Hashicorp Vault in production environments.
|
||||
This procedure provides instructions for configuring and enabling Server-Side Encryption using your selected `supported KMS solution <https://min.io/docs/kes/#supported-kms-targets>`__ in production environments.
|
||||
Specifically, this procedure assumes the following:
|
||||
|
||||
- An existing production-grade Vault deployment
|
||||
- One or more hosts for deploying KES
|
||||
- An existing production-grade KMS target
|
||||
- One or more KES servers connected to the KMS target
|
||||
- One or more hosts for a new or existing MinIO deployment
|
||||
|
||||
1) Download KES and Create the Service File
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Prerequisite
|
||||
~~~~~~~~~~~~
|
||||
|
||||
.. container:: procedure
|
||||
|
||||
a. Download KES
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-download-desc
|
||||
:end-before: end-kes-download-desc
|
||||
|
||||
b. Create the Service File
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-service-file-desc
|
||||
:end-before: end-kes-service-file-desc
|
||||
|
||||
2) Generate TLS Certificates for KES
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-kes-certs-prod-desc
|
||||
:end-before: end-kes-generate-kes-certs-prod-desc
|
||||
|
||||
Depending on your Vault configuration, you may also need to specify the CA used to sign the KES certificates to the Vault server.
|
||||
See the `Hashicorp Vault Configuration Docs <https://www.vaultproject.io/docs/configuration/listener/tcp#tls_client_ca_file>`__ for more information.
|
||||
Depending on your chosen :kes-docs:`supported KMS target <#supported-kms-targets>` configuration, you may need to pass the ``kes-server.cert`` as a trusted Certificate Authority (CA).
|
||||
Defer to the client documentation for instructions on trusting a third-party CA.
|
||||
|
||||
3) Generate a KES API Key for use by MinIO
|
||||
1) Generate a KES API Key for use by MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Starting with KES version :minio-git:`2023-02-15T14-54-37Z <kes/releases/tag/2023-02-15T14-54-37Z>`, you can generate an API key to use for authenticating to the KES server.
|
||||
@ -50,94 +28,50 @@ Use the :kes-docs:`kes identity new <cli/kes-identity/new>` command to generate
|
||||
|
||||
The output includes both the API Key for use with MinIO and the Identity hash for use with the :kes-docs:`KES Policy configuration <tutorials/configuration/#policy-configuration>`.
|
||||
|
||||
4) Create the KES and MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
2) Create the MinIO Configurations
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. important::
|
||||
Configure the MinIO Environment File
|
||||
|
||||
Starting with :minio-release:`RELEASE.2023-02-17T17-52-43Z`, MinIO requires expanded KES permissions for functionality.
|
||||
The example configuration in this section contains all required permissions.
|
||||
Create or modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables:
|
||||
|
||||
.. container:: procedure
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
a. Create the KES Configuration File
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
Create the configuration file using your preferred text editor.
|
||||
The following example uses ``nano``:
|
||||
3) Start MinIO
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
.. code-block:: shell
|
||||
:substitutions:
|
||||
.. admonition:: KES Operations Requires Unsealed Vault
|
||||
:class: important
|
||||
|
||||
nano /opt/kes/config.yaml
|
||||
Depending on your selected KMS solution, you may need to unseal the key instance to allow normal cryptographic operations, including key creation or retrieval.
|
||||
KES requires an unsealed key target to perform its operations.
|
||||
|
||||
Refer to the :kes-docs:`documentation for your chosen KMS solution <#supported-kms-targets>` for information regarding whether sealing and unsealing the instance is required for operations.
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-configuration-hashicorp-vault-desc
|
||||
:end-before: end-kes-configuration-hashicorp-vault-desc
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
- Set ``MINIO_IDENTITY_HASH`` to the identity hash of the API Key generated in the previous step.
|
||||
This step uses ``systemd`` for starting and managing the MinIO server processes:
|
||||
|
||||
The following command recomputes the necessary hash from the API key:
|
||||
Start the MinIO Server
|
||||
|
||||
.. code-block:: shell
|
||||
:class: copyable
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
kes identity of kes:v1:KEY/KEY
|
||||
|
||||
- Replace the ``keystore.vault.endpoint`` with the hostname of the Vault server(s).
|
||||
|
||||
- Replace ``keystore.vault.engine`` and ``keystore.vault.version`` with the path and version of the KV engine used for storing secrets.
|
||||
|
||||
- Replace the ``VAULTAPPID`` and ``VAULTAPPSECRET`` with the appropriate :ref:`Vault AppRole credentials <minio-sse-vault-prereq-vault>`.
|
||||
|
||||
- Modify the ``keystore.vault.tls.ca`` value to correspond to the path to the Vault :abbr:`CA (Certificate Authority)` certificate used to sign the Vault TLS keys.
|
||||
|
||||
b. Configure the MinIO Environment File
|
||||
|
||||
Create or modify the MinIO Server environment file for all hosts in the target deployment to include the following environment variables:
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-configuration-minio-desc
|
||||
:end-before: end-kes-configuration-minio-desc
|
||||
|
||||
MinIO defaults to expecting this file at ``/etc/default/minio``.
|
||||
If you modified your deployment to use a different location for the environment file, modify the file at that location.
|
||||
|
||||
5) Start KES and MinIO
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-vault-seal-unseal-desc
|
||||
:end-before: end-kes-vault-seal-unseal-desc
|
||||
|
||||
You must start KES *before* starting MinIO.
|
||||
The MinIO deployment requires access to KES as part of its startup.
|
||||
|
||||
This step uses ``systemd`` for starting and managing both the KES and MinIO server processes:
|
||||
|
||||
a. Start the KES Service on All Hosts
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-start-service-desc
|
||||
:end-before: end-kes-start-service-desc
|
||||
|
||||
b. Start the MinIO Server
|
||||
|
||||
.. include:: /includes/linux/common-minio-kes.rst
|
||||
:start-after: start-kes-minio-start-service-desc
|
||||
:end-before: end-kes-minio-start-service-desc
|
||||
|
||||
5) Generate a New Encryption Key
|
||||
4) Generate a New Encryption Key
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes-hashicorp.rst
|
||||
:start-after: start-kes-vault-seal-unseal-desc
|
||||
:end-before: end-kes-vault-seal-unseal-desc
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
:start-after: start-kes-generate-key-desc
|
||||
:end-before: end-kes-generate-key-desc
|
||||
|
||||
6) Enable SSE-KMS for a Bucket
|
||||
5) Enable SSE-KMS for a Bucket
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. include:: /includes/common/common-minio-kes.rst
|
||||
|
||||
Reference in New Issue
Block a user