You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Andreas Auernhammer b1845c6c83 kes: try to auto. create master key if not present (#9790) ... This commit changes the data key generation such that if a MinIO server/nodes tries to generate a new DEK but the particular master key does not exist - then MinIO asks KES to create a new master key and then requests the DEK again. From now on, a SSE-S3 master key must not be created explicitly via: `kes key create <key-name>`. Instead, it is sufficient to just set the env. var. ``` export MINIO_KMS_KES_KEY_NAME=<key-name> ``` However, the MinIO identity (mTLS client certificate) must have the permission to access the `/v1/key/create/` API. Therefore, KES policy for MinIO must look similar to: ``` [ /v1/key/create/<key-name-pattern> /v1/key/generate/<key-name-pattern> /v1/key/decrypt/<key-name-pattern> ] ``` However, in our guides we already suggest that. See e.g.: https://github.com/minio/kes/wiki/MinIO-Object-Storage#kes-server-setup *** The ability to create master keys on request may also be necessary / useful in case of SSE-KMS.		5 years ago
..
config.go	Add crypto context errors (#8740)	5 years ago
doc.go	…
error.go	Add crypto context errors (#8740)	5 years ago
header.go	…
header_test.go	…
help.go	…
kes.go	kes: try to auto. create master key if not present (#9790)	5 years ago
key.go	Add crypto context errors (#8740)	5 years ago
key_test.go	…
kms.go	…
kms_test.go	…
legacy.go	Add crypto context errors (#8740)	5 years ago
metadata.go	filter all encryption headers in gateway (#9661)	5 years ago
metadata_test.go	Add custom policy claim name (#8764)	5 years ago
parse.go	Add crypto context errors (#8740)	5 years ago
parse_test.go	…
retry.go	add kes retries upto two times with jitter backoff (#9527)	5 years ago
sse.go	…
sse_test.go	…
vault.go	Add crypto context errors (#8740)	5 years ago
vault_test.go	…