mirror of https://github.com/minio/minio.git
09626d78ff
With this commit, MinIO generates root credentials automatically and deterministically if: - No root credentials have been set. - A KMS (KES) is configured. - API access for the root credentials is disabled (lockdown mode). Before, MinIO defaults to `minioadmin` for both the access and secret keys. Now, MinIO generates unique root credentials automatically on startup using the KMS. Therefore, it uses the KMS HMAC function to generate pseudo-random values. These values never change as long as the KMS key remains the same, and the KMS key must continue to exist since all IAM data is encrypted with it. Backward compatibility: This commit should not cause existing deployments to break. It only changes the root credentials of deployments that have a KMS configured (KES, not a static key) but have not set any admin credentials. Such implementations should be rare or not exist at all. Even if the worst case would be updating root credentials in mc or other clients used to administer the cluster. Root credentials are anyway not intended for regular S3 operations. Signed-off-by: Andreas Auernhammer <github@aead.dev> |
||
|---|---|---|
| .. | ||
| amztime | ||
| arn | ||
| auth | ||
| bpool | ||
| bucket | ||
| cachevalue | ||
| color | ||
| config | ||
| crypto | ||
| deadlineconn | ||
| disk | ||
| dsync | ||
| etag | ||
| event | ||
| fips | ||
| grid | ||
| handlers | ||
| hash | ||
| http | ||
| init | ||
| ioutil | ||
| jwt | ||
| kms | ||
| lock | ||
| logger | ||
| lsync | ||
| mcontext | ||
| mountinfo | ||
| net | ||
| once | ||
| pubsub | ||
| rest | ||
| s3select | ||
| store | ||