Store HSM on Hashicorp Vault

MinIO KMS supports using Hashicorp Vault for storing the Hardware Security Module (HSM) key associated with a Root Encryption Key (REK).

The Vault instance stores the HSM such that a user with access to the cluster MinIO KMS has no immediate access to the plaintext key value. You can enable Vault at any time after completing the initial installation.

• The local or cluster MinIO KMS deployment for supporting AIStor Object Store Server Side Encryption
• The Hashicorp Vault deployment for storing the HSM.
• MinKMS Operator chart 1.1.2 or later
• MinIO KMS chart 2.0.2 or later

The Hashicorp Vault instance must provide support for the transit engine to support external HSM storage. The transit configuration must allow the following set of permissions:

path "transit/encrypt/minkms-sealing-key" {
   capabilities = [ "update" ]
}
path "transit/decrypt/minkms-sealing-key" {
   capabilities = [ "update" ]
}
path "transit/hmac/minkms-sealing-key" {
   capabilities = [ "update" ]
}

Refer to the Vault documentation for guidance on setup and configuration.

See the installation instructions for further guidance on deploying MinIO KMS.

1. Create the necessary tokens for authenticating to Vault

   MinIO KMS supports either the approle or the kubernetes authentication method.

   Prepare the following for this procedure:

   approle

   • A role_id
   • The corresponding secret_id

   The following optional value may be required depending on your configuration:

   • A namespace

   kubernetes

   • The service account role
   • The name or path to a service account JWT

   The following optional values may be required depending on your configuration:

   • The transit engine namespace
   • The auth mount path

2. Modify the values file for the cluster MinIO KMS

   Open the chart values file in your preferred text editor and add the minkms.configuration.hsm.hashicorp.vault section:

   approle

   # minkms-values.yaml
   
   # Other configuration settings above this line
   minkms:
      configuration:
         hsm:
            vault:
               server: https://vault.example.net:8200
               approle:
                  id: UUID # App Role ID
                  secret: UUID # App Role Secret
                  namespace: ns-1 # Optional namespace for the approle
                  path: approle # Optional mount point for the approle
               transit:
                  key: minkms-hsm
                  namespace: ns-1 # Optional namespace for the transit engine
                  path: transit # Optional mount point for the transit engine
   

   kubernetes

   # minkms-values.yaml
   
   # Other configuration settings above this line
   minkms:
      configuration:
         hsm:
            vault:
               server: https://vault.example.net:8200
               approle:
                  id: UUID # App Role ID
                  secret: UUID # App Role Secret
                  namespace: ns-1 # Optional namespace for the approle
                  path: approle # Optional mount point for the approle
               kubernetes:
                  role: minkms-role
                  jwt: /tmp/kubernetes/jwt
                  namespace: ns-3 # Optional namespace for the kubernetes auth
                  path: kubernetes # Optional mount point for the kubernetes auth
   

3. (Optional) Disable the local HSM

   You can disable the local HSM used to initialize the cluster MinIO KMS after configuring the external HSM. This prevents using that HSM or its associated Root Encryption Key (REK) for accessing the encryption key database.

   To disable the local HSM, comment out or remove the minkms.configuration.hsm.key value from the values.yaml file.

4. Update the chart with the new values.yaml:

   Use the helm upgrade command to upgrade the chart with the new values.yaml:

   helm upgrade minkms minio/minkms \
     -n minkms \
     -f minkms-values.yaml