21797d127b
Closes #610 Did a QA pass after reports of some issues with the vault setup. Identified an issue where my local testing was done with 0.20.0, resulting in some errors on 0.21.0 due to dropping --mlock. Also did a few other general tune ups as I ran end-to-ends again using Vault + Systemd instead of vault in dev mode. Staging views in #minio-docs channel
4.9 KiB
Enable Server-Side Encryption using Hashicorp Vault for Local Development
This procedure assumes deploying MinIO and KES onto the same host. You can use and modify the information below to better suit your local development environment.
This procedure assumes the following:
- An existing Vault deployment
- A single host machine for deploying KES and MinIO
Set Up Folder Hierarchy
Create the following folders on the host machine if they do not already exist.
mkdir -P |kescertpath|
mkdir -P |kesconfigpath|
mkdir -P |miniocertpath|
mkdir -P |minioconfigpath|
mkdir -P |miniodatapath|This procedure uses these paths in the following steps. If you use different paths, make the necessary modifications for each step to reflect those changes
1) Download the KES Server Binary
2) Generate TLS Certificates for KES and MinIO
Depending on your Vault configuration, you may need to pass the
kes-server.cert certificate as a trusted Certificate
Authority. See the Hashicorp
Server Configuration Documentation for more information. Defer to
the client documentation for instructions on trusting a third-party
CA.
3) Create the KES and MinIO Configurations
Create the KES Configuration File
Create the configuration file using your preferred text editor. The following example uses
nano:nano |kesconfigpath|/kes-config.yamlSet
MINIO_IDENTITY_HASHto the identity hash of the MinIO mTLS certificate.The following command computes the necessary hash:
kes identity of |miniocertpath|/minio-kes.certReplace the
vault.endpointwith the hostname of the Vault server(s).Set the
vault.engineandvault.versionto the appropriate values for the Vault K/V Engine configurationReplace the
VAULTAPPIDandVAULTAPPSECRETwith the appropriateVault AppRole credentials <minio-sse-vault-prereq-vault>.
Create the MinIO Environment File
Create or modify the environment file for the MinIO deployment using your preferred text editor. The following example uses
nano:nano |minioconfigpath|/minio
4) Start KES and MinIO
You must start KES before starting MinIO. The MinIO deployment requires access to KES as part of its startup.
- Start the KES Server
- Start the MinIO Server
Foreground processes depend on the shell or terminal in which they run. Exiting or terminating the shell/terminal instance also kills the attached process. Defer to your operating system best practices for running processes in the background.