cleanup markdown docs across multiple files (#14296)

enable markdown-linter

docs/kms/IAM.md

@@ -2,7 +2,7 @@
 
 MinIO supports encrypting config, IAM assets with KMS provided keys. If the KMS is not enabled, MinIO will store the config, IAM data as plain text erasure coded in its backend.
 
-### MinIO KMS Quick Start
+## MinIO KMS Quick Start
 
 MinIO supports two ways of encrypting IAM and configuration data.
 You can either use KES - together with an external KMS - or, much simpler,
@@ -12,36 +12,42 @@ to set it up refer to our [KMS Guide](https://github.com/minio/minio/blob/master
 Instead of configuring an external KMS you can start with a single key by
 setting the env. variable `MINIO_KMS_SECRET_KEY`. It expects the following
 format:
+
 ```sh
 MINIO_KMS_SECRET_KEY=<key-name>:<base64-value>
 ```
 
 First generate a 256 bit random key via:
+
 ```sh
 $ cat /dev/urandom | head -c 32 | base64 -
 OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
 ```
 
 Now, you can set `MINIO_KMS_SECRET_KEY` like this:
+
 ```sh
 export MINIO_KMS_SECRET_KEY=my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
 ```
+
 > You can choose an arbitrary name for the key - instead of `my-minio-key`.
 > Please note that loosing the `MINIO_KMS_SECRET_KEY` will cause data loss
 > since you will not be able to decrypt the IAM/configuration data anymore.
-For distributed MinIO deployments, specify the *same* `MINIO_KMS_SECRET_KEY` for each MinIO server process. 
+For distributed MinIO deployments, specify the *same* `MINIO_KMS_SECRET_KEY` for each MinIO server process.
 
 At any point in time you can switch from `MINIO_KMS_SECRET_KEY` to a full KMS
 deployment. You just need to import the generated key into KES - for example via
 the KES CLI once you have successfully setup KES:
+
 ```sh
 kes key create my-minio-key OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
 ```
-- For instructions on setting up KES, see the [KES Getting Started guide](https://github.com/minio/kes/wiki/Getting-Started) 
+
+- For instructions on setting up KES, see the [KES Getting Started guide](https://github.com/minio/kes/wiki/Getting-Started)
 
 - For instructions on using KES for encrypting the MinIO backend, follow the [KMS Quick Start](https://github.com/minio/minio/tree/master/docs/kms). The SSE-S3 configuration setup also supports MinIO KMS backend encryption.
 
-### FAQ
+## FAQ
 
 > Why is this change needed?
 
@@ -51,13 +57,14 @@ Now, MinIO encrypts IAM / configuration and S3 objects with a KMS, if present. T
 change unified the key-management aspect within MinIO.
 
 The unified KMS-based approach has several advantages:
- - Key management is now centralized. There is one way to change or rotate encryption keys.
+
+- Key management is now centralized. There is one way to change or rotate encryption keys.
    There used to be two different mechanisms - one for regular S3 objects and one for IAM data.
- - Reduced server startup time. For IAM encryption with the root credentials, MinIO had
+- Reduced server startup time. For IAM encryption with the root credentials, MinIO had
    to use a memory-hard function (Argon2) that (on purpose) consumes a lot of memory and CPU.
    The new KMS-based approach can use a key derivation function that is orders of magnitudes
    cheaper w.r.t. memory and CPU.
- - Root credentials can now be changed easily. Before, a two-step process was required to
+- Root credentials can now be changed easily. Before, a two-step process was required to
    change the cluster root credentials since they were used to en/decrypt the IAM data.
    So, both - the old and new credentials - had to be present at the same time during a rotation
    and the old credentials had to be removed once the rotation completed. This process is now gone.

docs/kms/README.md

@@ -6,7 +6,8 @@ MinIO uses a key-management-system (KMS) to support SSE-S3. If a client requests
 
 MinIO supports multiple KMS implementations via our [KES](https://github.com/minio/kes#kes) project. We run a KES instance at `https://play.min.io:7373` for you to experiment and quickly get started. To run MinIO with a KMS just fetch the root identity, set the following environment variables and then start your MinIO server. If you havn't installed MinIO, yet, then follow the MinIO [install instructions](https://docs.min.io/docs/minio-quickstart-guide) first.
 
-#### 1. Fetch the root identity
+### 1. Fetch the root identity
+
 As the initial step, fetch the private key and certificate of the root identity:
 
 ```sh
@@ -15,7 +16,7 @@ curl -sSL --tlsv1.2 \
      -O 'https://raw.githubusercontent.com/minio/kes/master/root.cert'
 ```
 
-#### 2. Set the MinIO-KES configuration
+### 2. Set the MinIO-KES configuration
 
 ```sh
 export MINIO_KMS_KES_ENDPOINT=https://play.min.io:7373
@@ -24,7 +25,7 @@ export MINIO_KMS_KES_CERT_FILE=root.cert
 export MINIO_KMS_KES_KEY_NAME=my-minio-key
 ```
 
-#### 3. Start the MinIO Server
+### 3. Start the MinIO Server
 
 ```sh
 export MINIO_ROOT_USER=minio
@@ -39,6 +40,7 @@ minio server ~/export
 ## Configuration Guides
 
 A typical MinIO deployment that uses a KMS for SSE-S3 looks like this:
+
 ```
     ┌────────────┐
     │ ┌──────────┴─┬─────╮          ┌────────────┐
@@ -61,7 +63,6 @@ The main difference between various MinIO-KMS deployments is the KMS implementat
 | [Google Cloud Platform SecretManager](https://github.com/minio/kes/wiki/GCP-SecretManager)   | Cloud KMS. MinIO in combination with a managed KMS installation   |
 | [FS](https://github.com/minio/kes/wiki/Filesystem-Keystore)                                  | Local testing or development (**Not recommended for production**) |
 
-
 The MinIO-KES configuration is always the same - regardless of the underlying KMS implementation. Checkout the MinIO-KES [configuration example](https://github.com/minio/kes/wiki/MinIO-Object-Storage).
 
 ### Further references
@@ -72,27 +73,34 @@ The MinIO-KES configuration is always the same - regardless of the underlying KM
 - [Understand the KES server concepts](https://github.com/minio/kes/wiki/Concepts)
 
 ## Auto Encryption
+
 Auto-Encryption is useful when MinIO administrator wants to ensure that all data stored on MinIO is encrypted at rest.
 
 ### Using `mc encrypt` (recommended)
+
 MinIO automatically encrypts all objects on buckets if KMS is successfully configured and bucket encryption configuration is enabled for each bucket as shown below:
+
 ```
 mc encrypt set sse-s3 myminio/bucket/
 ```
 
 Verify if MinIO has `sse-s3` enabled
+
 ```
 mc encrypt info myminio/bucket/
 Auto encryption 'sse-s3' is enabled
 ```
 
 ### Using environment (not-recommended)
+
 MinIO automatically encrypts all objects on buckets if KMS is successfully configured and following ENV is enabled:
+
 ```
 export MINIO_KMS_AUTO_ENCRYPTION=on
 ```
 
 ### Verify auto-encryption
+
 > Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends
 > e.g. SSE-C headers, MinIO will encrypt the object with the key sent by the client and won't reach out to
 > the configured KMS.