You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Andreas Auernhammer a6f4cf61f2 add `UpdateKey` method to KMS interface (#7974) ... This commit adds a new method `UpdateKey` to the KMS interface. The purpose of `UpdateKey` is to re-wrap an encrypted data key (the key generated & encrypted with a master key by e.g. Vault). For example, consider Vault with a master key ID: `master-key-1` and an encrypted data key `E(dk)` for a particular object. The data key `dk` has been generated randomly when the object was created. Now, the KMS operator may "rotate" the master key `master-key-1`. However, the KMS cannot forget the "old" value of that master key since there is still an object that requires `dk`, and therefore, the `D(E(dk))`. With the `UpdateKey` method call MinIO can ask the KMS to decrypt `E(dk)` with the old key (internally) and re-encrypted `dk` with the new master key value: `E'(dk)`. However, this operation only works for the same master key ID. When rotating the data key (replacing it with a new one) then we perform a `UnsealKey` operation with the 1st master key ID and then a `GenerateKey` operation with the 2nd master key ID. This commit also updates the KMS documentation and removes the `encrypt` policy entry (we don't use `encrypt`) and add a policy entry for `rewarp`.		5 years ago
..
config.go	…
doc.go	…
error.go	add `UpdateKey` method to KMS interface (#7974)	5 years ago
header.go	…
header_test.go	…
key.go	…
key_test.go	…
kms.go	add `UpdateKey` method to KMS interface (#7974)	5 years ago
kms_test.go	add `UpdateKey` method to KMS interface (#7974)	5 years ago
metadata.go	…
metadata_test.go	…
sse.go	…
sse_test.go	…
vault.go	add `UpdateKey` method to KMS interface (#7974)	5 years ago
vault_test.go	…