kes migrate

Overview

The kes migrate command supports migrating master keys from one KMS instance to another KMS instance. For example, you can use the command to migrate a Hashicorp Vault instance to another Hashicorp Vault instance. Or, kes migrate can migrate a Hashicorp Vault instance to or from an AWS Secrets Manager KMS.

The KMS instances do not need to be of the same type or provider.

The migrate command must have direct access to both KMS instances at the same time.

Syntax

To migrate keys to another KMS that KES supports, use --to:

kes migrate         \
    --from <path>   \
    --to <path>     \
    [--force, -f]   \
    [--merge]       \
    [<pattern>]

To migrate keys to a MinIO KMS enclave, use --server, --enclave, and --api-key:

kes migrate                 \
    --from <path>           \
    --server <host>         \
    --enclave <enclave>     \
    --api-key <key>         \
    [--insecure, -k]        \
    [--force, -f]           \
    [--merge]               \
    [<pattern>]

Parameters

`--from`

Required

Specify the path to the KES config file for the old KMS (the source) you are moving keys from.

`--to`

Required unless you use --server

Specify the path to the KES config file for the new KMS (the target) you are moving keys to. You cannot use --to with --server, --enclave, --api-key, or --insecure.

`--server, -s`

Required unless you use --to

The MinIO KMS server endpoint to migrate keys to. Defaults to the value of the MINIO_KMS_SERVER environment variable.

`--enclave, -e`

Required with --server

The MinIO KMS enclave to migrate keys to. Defaults to the value of the MINIO_KMS_ENCLAVE environment variable.

`--api-key, -a`

Required with --server

The API key to authenticate to the MinIO KMS server. Defaults to the value of the MINIO_KMS_API_KEY environment variable.

`--insecure, -k`

Optional

Skip verification of the MinIO KMS server certificate.

`--force, -f`

Optional

Migrate keys to the new KMS even if a key with the same name exists. The migration process overwrites existing keys on the target server with the keys from the source server when you pass this flag.

`--merge`

Optional

Preserves keys that exist on the target server and only migrates keys from the old server with names that do not exist on the target server. You cannot use --merge with --force.

`<pattern>`

Optional

A text pattern with wildcards to use to find specific keys to migrate.

Examples

Migrate All Master Keys

kes migrate --from vault-config.yml --to aws-config.yml

Migrate Some Master Keys

To migrate a subset of all master keys, specify a pattern. Only master keys that match the pattern migrate.

kes migrate --from <source.yml> --to <target.yml> <pattern>

For example:

kes migrate --from source.yml --to target.yml my-key*

Migrate a Single Key

To migrate a single master key, specify the key name.

kes migrate --from <source.yml> --to <target.yml> <key-name>

For example:

kes migrate --from source.yml --to target.yml my-master-key

kes migrate

On this page