kms: encrypt IAM/config data with the KMS (#12041)

Browse Source

This commit changes the config/IAM encryption
process. Instead of encrypting config data
(users, policies etc.) with the root credentials
MinIO now encrypts this data with a KMS - if configured.

Therefore, this PR moves the MinIO-KMS configuration (via
env. variables) to a "top-level" configuration.
The KMS configuration cannot be stored in the config file
since it is used to decrypt the config file in the first
place.

As a consequence, this commit also removes support for
Hashicorp Vault - which has been deprecated anyway.

Signed-off-by: Andreas Auernhammer <aead@mail.de>

...

This commit is contained in:

Andreas Auernhammer

2021-04-22 17:45:30 +02:00

committed by Harshavardhana

parent e05e14309c

commit 3455f786fa

41 changed files with 553 additions and 2157 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

295

cmd/apierrorcode_string.go

File diff suppressed because one or more lines are too long