minio/docs
Andreas Auernhammer a6f4cf61f2 add UpdateKey method to KMS interface (#7974)
This commit adds a new method `UpdateKey` to the KMS
interface.

The purpose of `UpdateKey` is to re-wrap an encrypted
data key (the key generated & encrypted with a master key by e.g.
Vault).
For example, consider Vault with a master key ID: `master-key-1`
and an encrypted data key `E(dk)` for a particular object. The
data key `dk` has been generated randomly when the object was created.
Now, the KMS operator may "rotate" the master key `master-key-1`.
However, the KMS cannot forget the "old" value of that master key
since there is still an object that requires `dk`, and therefore,
the `D(E(dk))`.
With the `UpdateKey` method call MinIO can ask the KMS to decrypt
`E(dk)` with the old key (internally) and re-encrypted `dk` with
the new master key value: `E'(dk)`.

However, this operation only works for the same master key ID.
When rotating the data key (replacing it with a new one) then
we perform a `UnsealKey` operation with the 1st master key ID
and then a `GenerateKey` operation with the 2nd master key ID.

This commit also updates the KMS documentation and removes
the `encrypt` policy entry (we don't use `encrypt`) and
add a policy entry for `rewarp`.
2019-08-01 15:47:47 -07:00
..
bigdata Update docs with new settings (#7803) 2019-06-18 17:52:27 -07:00
bucket/notifications Enable event persistence in AMQP (#7565) 2019-07-25 11:20:24 -07:00
chroot Removes the incorrect coverage badge from the docs (#7651) 2019-05-16 12:11:49 +05:30
compression Update compression README.md (#7823) 2019-06-23 13:52:58 +05:30
config Enable event persistence in AMQP (#7565) 2019-07-25 11:20:24 -07:00
deployment/kernel-tuning Removes the incorrect coverage badge from the docs (#7651) 2019-05-16 12:11:49 +05:30
disk-caching Revert "cache: Rewrite to cache only on download (#7575)" (#7684) 2019-05-22 14:54:15 -07:00
distributed Add some design docs for distributed setup (#7950) 2019-07-23 07:48:10 +05:30
docker docs: Use --user to start container in non-root (#7966) 2019-07-24 17:35:52 -07:00
erasure docs: Fix dead link of HighwayHash (#7847) 2019-07-03 14:32:58 -07:00
federation/lookup Migrate minio etcd config to backend config (#7751) 2019-06-15 03:07:54 -07:00
gateway Add krb5 support for HDFS gateway (#7933) 2019-07-24 18:05:48 -07:00
kms add UpdateKey method to KMS interface (#7974) 2019-08-01 15:47:47 -07:00
logging Replace Minio refs in docs with MinIO and links (#7494) 2019-04-09 11:39:42 -07:00
metrics Replace Minio refs in docs with MinIO and links (#7494) 2019-04-09 11:39:42 -07:00
multi-tenancy Removes the incorrect coverage badge from the docs (#7651) 2019-05-16 12:11:49 +05:30
multi-user doc: "admin user policy" command typo (#7865) 2019-07-02 11:48:26 -07:00
orchestration Update yaml files to latest version RELEASE.2019-08-01T22-18-54Z 2019-08-01 22:27:41 +00:00
screenshots doc: Merge large bucket with distributed docs (#7761) 2019-06-11 13:44:33 -07:00
security Replace Minio refs in docs with MinIO and links (#7494) 2019-04-09 11:39:42 -07:00
select Replace Minio refs in docs with MinIO and links (#7494) 2019-04-09 11:39:42 -07:00
shared-backend Removes the incorrect coverage badge from the docs (#7651) 2019-05-16 12:11:49 +05:30
sts Add support for session policies in STS APIs (#7747) 2019-06-20 15:28:33 -07:00
tls remove encryption key section for certtool docs (#7820) 2019-06-21 10:39:02 -07:00
zh_CN docs: Fix dead link of HighwayHash (#7847) 2019-07-03 14:32:58 -07:00
minio-limits.md Clarify server maximums via Federation (#7608) 2019-05-01 16:20:25 -07:00