d5d3243413
@djwfyi cursory review in case I missed something. Closes #580 I do need to do further testing beyond the patches here. But I'm going to handle that out-of-band.
3.5 KiB
Deploy MinIO and KES with Server-Side Encryption using GCP Secrets Manager for Local Development
Prior to starting these steps, create the following folders:
mkdir -P |kescertpath|
mkdir -P |kesconfigpath|
mkdir -P |miniocertpath|
mkdir -P |minioconfigpath|
mkdir -P |miniodatapath|1) Download the KES Server Binary
2) Generate TLS Certificates for KES and MinIO
3) Create the KES and MinIO Configurations
Create the KES Configuration File
Create the configuration file using your preferred text editor. The following example uses
nano:nano |kesconfigpath|/kes-config.yamlSet
MINIO_IDENTITY_HASHto the identity hash of the MinIO mTLS certificate.The following command computes the necessary hash:
kes identity of |miniocertpath|/minio-kes.certSet
GCPPROJECTIDto the GCP project for the Secrets Manager instance KES should use.Set
GCPCLIENTEMAIL,GCPCLIENTID,GCPPRIVATEKEYID, andGCPPRIVATEKEYto the credentials associated to theGCP Service Account <minio-sse-gcp-prereq-gcp>KES should use when accessing the Secrets Manager service.
Create the MinIO Environment File
Create or modify the environment file for the MinIO deployment using your preferred text editor. The following example uses
nano:nano |minioconfigpath|/minio
4) Start KES and MinIO
You must start KES before starting MinIO. The MinIO deployment requires access to KES as part of its startup.
- Start the KES Server
- Start the MinIO Server
Foreground processes depend on the shell or terminal in which they run. Exiting or terminating the shell/terminal instance also kills the attached process. Defer to your operating system best practices for running processes in the background.