MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-20 02:27:50 -04:00
Code Issues Packages Projects Releases Wiki Activity

update KES docs to talk about 'mc encrypt' command (#10400)

Browse Source 
add a deprecation notice for KMS_AUTO_ENCRYPTION
This commit is contained in:
Harshavardhana 2020-09-03 12:43:45 -07:00 committed by GitHub
parent c51229493b
commit b4e3956e69
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/common-main.go
View File

@ -50,7 +50,7 @@ func init() {
} }
func verifyObjectLayerFeatures(name string, objAPI ObjectLayer) { func verifyObjectLayerFeatures(name string, objAPI ObjectLayer) {
if (globalAutoEncryption || GlobalKMS != nil) && !objAPI.IsEncryptionSupported() { if (GlobalKMS != nil) && !objAPI.IsEncryptionSupported() {
logger.Fatal(errInvalidArgument, logger.Fatal(errInvalidArgument,
"Encryption support is requested but '%s' does not support encryption", name) "Encryption support is requested but '%s' does not support encryption", name)
} }

3
cmd/config-current.go
View File

@ -417,6 +417,9 @@ func lookupConfigs(s config.Config, setDriveCount int) {
// Enable auto-encryption if enabled // Enable auto-encryption if enabled
globalAutoEncryption = kmsCfg.AutoEncryption globalAutoEncryption = kmsCfg.AutoEncryption
if globalAutoEncryption {
logger.LogIf(ctx, fmt.Errorf("%s env is deprecated please migrate to using `mc encrypt` at bucket level", crypto.EnvKMSAutoEncryption))
}
globalCompressConfig, err = compress.LookupConfig(s[config.CompressionSubSys][config.Default]) globalCompressConfig, err = compress.LookupConfig(s[config.CompressionSubSys][config.Default])
if err != nil { if err != nil {

21
docs/kms/README.md
View File

@ -79,27 +79,32 @@ Checkout the MinIO-KES [configuration example](https://github.com/minio/kes/wiki
## Auto Encryption ## Auto Encryption
Optionally, you can instruct the MinIO server to automatically encrypt all objects with keys from the KES Auto-Encryption is useful when MinIO administrator wants to ensure that all data stored on MinIO is encrypted at rest.
server - even if the client does not specify any encryption headers during the S3 PUT operation.
Auto-Encryption is especially useful when the MinIO operator wants to ensure that all data stored on MinIO MinIO automatically encrypts all objects on buckets if KMS is successfully configured and bucket encryption configuration is enabled for each bucket as shown below:
gets encrypted before it's written to the storage backend. ```
mc encrypt sse-s3 myminio/bucket/
```
To enable auto-encryption set the environment variable to `on`: Verify if MinIO has `sse-s3` enabled
``` ```
export MINIO_KMS_AUTO_ENCRYPTION=on mc encrypt info myminio/bucket/
Auto encryption 'sse-s3' is enabled
``` ```
> Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends > Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends
> e.g. SSE-C headers, MinIO will encrypt the object with the key sent by the client and won't reach out to > e.g. SSE-C headers, MinIO will encrypt the object with the key sent by the client and won't reach out to
> the KMS. > the configured KMS.
To verify auto-encryption, use the `mc` command: To verify auto-encryption, use the following `mc` command:
``` ```
mc cp test.file myminio/bucket/ mc cp test.file myminio/bucket/
test.file: 5 B / 5 B ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 100.00% 337 B/s 0s test.file: 5 B / 5 B ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 100.00% 337 B/s 0s
```
```
mc stat myminio/bucket/test.file mc stat myminio/bucket/test.file
Name : test.file Name : test.file
... ...