docs/source/includes/common/common-minio-kes-gcp.rst

|KES| uses a YAML-formatted configuration file. The following example YAML specifies the minimum required fields for enabling |SSE| using GCP Secrets Manager:

address: 0.0.0.0:7373

# Disable the root identity, as we do not need that level of access for
# supporting SSE operations.
root: disabled

# Specify the TLS keys generated in the previous step here
# For production environments, use keys signed by a known and trusted
# Certificate Authority (CA).
tls:
  key:  |kesconfigcertpath|kes-server.key
  cert: |kesconfigcertpath|kes-server.cert

# Create a policy named 'minio' that grants access to the 
# /create, /generate, and /decrypt KES APIs for any key name
# KES uses mTLS to grant access to this policy, where only the client 
# whose TLS certificate hash matches one of the "identities" can
# use this policy. Specify the hash of the MinIO server TLS certificate
# hash here.
policy:
  minio:
    allow:
    - /v1/key/create/*   # You can replace these wildcard '*' with a string prefix to restrict key names
    - /v1/key/generate/* # e.g. '/minio-'
    - /v1/key/decrypt/*
    - /v1/key/bulk/decrypt
    - /v1/key/list
    - /v1/status
    - /v1/metrics
    - /v1/log/audit
    - /v1/log/error
    identities:
    - ${MINIO_IDENTITY_HASH} # Replace with the output of 'kes identity of minio-kes.cert'

# Specify the connection information for the  Secrets Manager endpoint.
# The endpoint should be resolvable from the host.
# This example assumes that the associated GCP account has the necessary
# access key and secret key
keystore:
  gcp:
    secretmanager:
      project_id: "${GCPPROJECTID}" # The GCP Project to use
      credentials:
        client_email: "${GCPCLIENTEMAIL}" # The client email for your GCP Credentials
        client_id: "${GCPCLIENTID}" # The Client ID for your GCP Credentials
        private_key_id: "${GCPPRIVATEKEYID}" # the private key ID for your GCP credentials
        private_key: "${GCPPRIVATEKEY}" # The content of your GCP Private Key