Server Side Encryption with MinIO KMS

This procedure enables Server-Side Encryption (SSE) on a Kubernetes MinIO AIStor deployment using MinIO KMS as the key manager. MinIO KMS is the recommended key manager for new deployments.

For background on how AIStor encrypts data and the encryption types it supports, see Enable Server-Side Encryption.

MinIO KMS requires TLS connectivity between client and server to protect cryptographic payloads during transmission.

The MinIO AIStor Operator by default deploys resources with TLS automatically configured. If you manually disabled TLS in the cluster, review the networking tutorial for guidance on re-enabling TLS.

MinIO AIStor authenticates to MinIO KMS with mutual TLS (mTLS), where the client presents its own certificate to the server during the TLS handshake. MinIO AIStor derives that client certificate from the MINIO_KMS_API_KEY value and presents it on every connection. MinIO KMS identifies the caller from the public key in the certificate. It does not validate the certificate against a certificate authority (CA), so there is no client CA to configure on the MinIO KMS side.

The client certificate reaches MinIO KMS only if nothing along the way terminates TLS. Address MinIO KMS by its in-cluster Service, which passes the connection through unchanged. If you instead reach MinIO KMS from outside the cluster or through a proxy, that path must be TCP (Layer 4) passthrough. Do not place MinIO KMS behind an HTTP or HTTPS (Layer 7) Ingress. A Layer 7 Ingress terminates TLS and opens its own connection to MinIO KMS, so the client certificate never arrives and requests fail with the following message:

client certificate required: client has not sent any certificate during the TLS handshake

This procedure assumes you have an existing MinIO KMS deployment. See the MinIO KMS documentation for guidance on installation and configuration.

From that tutorial you need the MinIO KMS server endpoints and three resources. Create the resources in the order listed, because each one depends on the previous:

1. An enclave dedicated to this object store. An enclave is an isolated namespace within MinIO KMS that holds its own keys and identities. Create it with the minkms add-enclave command.

2. An administrator identity scoped to that enclave, created with the minkms add-identity command and its --admin flag. The command prints an API key once and cannot display it again, so record it before continuing. Do not reuse the MinIO KMS cluster administrator API key. MinIO AIStor logs a warning at startup if the API key it receives has SysAdmin privileges.

3. A default SSE key inside that enclave, created with the minkms add-key command.

Each value maps onto one of the environment variables you set later in this procedure:

This procedure uses Helm and assumes an existing MinIO AIStor deployment

1. Retrieve the current Chart values

   Use the helm get values command to retrieve the current Chart values.yaml:

   helm get values OBJECT-STORE-NAME -n OBJECT-STORE-NAMESPACE -o yaml > aistor-object-store-name-values.yaml
   

   Create a backup of the file with the -bak.yaml suffix for records. If you use Git or a similar version control technology, you can use that system for retrieving the values file instead.

   Review the value of objectStore.configuration.name. This name points to the secret containing the object store configuration file in the namespace and is required in the next step. If you did not override this value, it defaults to myaistor-env-configuration.

2. Retrieve the configuration secret.

   Create a local copy of the secret using the kubectl get command:

   kubectl get secret/myaistor-env-configuration -n OBJECT-STORE-NAMESPACE -o yaml > myaistor-env-configuration.yaml
   

   Replace the myaistor-env-configuration with the value of objectStore.configuration.name from your Helm chart.

3. Retrieve the configuration

   The data.config.env field in the secret contains the base64-encoded configuration. The following command uses the yq and base64 utilites to decode and save the file:

   yq -r '.data."config.env"' myaistor-env-configuration.yaml | base64 -d > myaistor-env-configuration
   

   The file contains any environment variables previously set or configured for the object store.

4. Add MinIO KMS settings to the environment file

   Open the myaistor-env-configuration file in your preferred text editor and add the following lines:

    # MinIO KMS settings
   
    # Provide the address of the MinIO KMS Service in your Kubernetes cluster.
    # Replace KMS-RELEASE-NAME and KMS-NAMESPACE with the Helm release name and namespace of your MinIO KMS deployment.
    # Any other path must pass TLS through unchanged, or mutual TLS authentication breaks.
   
    MINIO_KMS_SERVER="https://KMS-RELEASE-NAME-minkms.KMS-NAMESPACE.svc.cluster.local:7373"
   
    # Specify the name for the default encryption key
    # This key is used for backend and default bucket encryption.
    # Consider specifying a unique key name to facilitate easy identification among other stored keys.
    #
    # Do not modify the MINIO_KMS_SSE_KEY value after setup.
    # MinIO AIStor requires this key to start successfully.
   
    MINIO_KMS_SSE_KEY="object-store-primary-default-key"
   
    # Specify the MinIO KMS enclave to use
   
    MINIO_KMS_ENCLAVE="object-store-primary"
   
    # Specify the MinIO KMS API key to use for authenticating operations.
    # The API key must have permission to access and perform operations in the MinIO KMS enclave
   
    MINIO_KMS_API_KEY="k1:APIKEYSTRING"
   

5. Update the secret YAML

   Re-encode the updated environment file using base64 and replace the data.config.env value.

6. Re-apply the secret

   Use kubectl apply to apply the secret and update the configuration setting in the Namespace.

7. Restart MinIO AIStor

   Delete all MinIO AIStor StatefulSets to update the configurations for all Pods simultaneously. Use kubectl delete sts/...

8. Enable bucket default encryption

   Use the mc CLI tool to connect to the MinIO AIStor deployment. Use the mc encrypt set command to set bucket default encryption.

   For example:

   mc mb object-store-k8s/data
   mc encrypt set sse-kms object-store-k8s/data
   

   To encrypt a bucket with a dedicated key instead of the default key, create the key with mc admin kms key create first:

   mc admin kms key create object-store-k8s data-bucket-encryption-key
   mc mb object-store-k8s/data
   mc encrypt set sse-kms data-bucket-encryption-key object-store-k8s/data