update KES docs to talk about 'mc encrypt' command (#10400)

add a deprecation notice for KMS_AUTO_ENCRYPTION

cmd/common-main.go

@@ -50,7 +50,7 @@ func init() {
 }
 
 func verifyObjectLayerFeatures(name string, objAPI ObjectLayer) {
-	if (globalAutoEncryption || GlobalKMS != nil) && !objAPI.IsEncryptionSupported() {
+	if (GlobalKMS != nil) && !objAPI.IsEncryptionSupported() {
 		logger.Fatal(errInvalidArgument,
 			"Encryption support is requested but '%s' does not support encryption", name)
 	}

cmd/config-current.go

@@ -417,6 +417,9 @@ func lookupConfigs(s config.Config, setDriveCount int) {
 
 	// Enable auto-encryption if enabled
 	globalAutoEncryption = kmsCfg.AutoEncryption
+	if globalAutoEncryption {
+		logger.LogIf(ctx, fmt.Errorf("%s env is deprecated please migrate to using `mc encrypt` at bucket level", crypto.EnvKMSAutoEncryption))
+	}
 
 	globalCompressConfig, err = compress.LookupConfig(s[config.CompressionSubSys][config.Default])
 	if err != nil {

docs/kms/README.md

@@ -79,27 +79,32 @@ Checkout the MinIO-KES [configuration example](https://github.com/minio/kes/wiki
 
 ## Auto Encryption
 
-Optionally, you can instruct the MinIO server to automatically encrypt all objects with keys from the KES
+Auto-Encryption is useful when MinIO administrator wants to ensure that all data stored on MinIO is encrypted at rest. 
-server - even if the client does not specify any encryption headers during the S3 PUT operation.
 
-Auto-Encryption is especially useful when the MinIO operator wants to ensure that all data stored on MinIO
+MinIO automatically encrypts all objects on buckets if KMS is successfully configured and bucket encryption configuration is enabled for each bucket as shown below:
-gets encrypted before it's written to the storage backend.
+```
+mc encrypt sse-s3 myminio/bucket/
+```
 
-To enable auto-encryption set the environment variable to `on`:
+Verify if MinIO has `sse-s3` enabled
 ```
-export MINIO_KMS_AUTO_ENCRYPTION=on
+mc encrypt info myminio/bucket/
+Auto encryption 'sse-s3' is enabled
 ```
 
+
 > Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends
 > e.g. SSE-C headers, MinIO will encrypt the object with the key sent by the client and won't reach out to
-> the KMS.
+> the configured KMS.
 
-To verify auto-encryption, use the `mc` command:
+To verify auto-encryption, use the following `mc` command:
 
 ```
 mc cp test.file myminio/bucket/
 test.file:              5 B / 5 B  ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓  100.00% 337 B/s 0s
+```
 
+```
 mc stat myminio/bucket/test.file
 Name      : test.file
 ...