KES Environment Variables

The following environment variables configure the use of a MinIO Key Encryption Service (KES) server.

Two separate processes read them. The MINIO_KMS_KES_* variables tell an AIStor Object Store server how to reach a KES server and which key to use. The MINIO_KES_* variables tell the kes command line client how to reach a KES server.

Set these variables on each AIStor Object Store host that uses KES.

The endpoint for the MinIO Key Encryption Service (KES) process to use for supporting SSE-S3 and MinIO backend encryption operations. By default, KES binds to port 7373 on all network interfaces.

The API key the object store uses to authenticate to the KES server. This variable is mutually exclusive with MINIO_KMS_KES_KEY_FILE and MINIO_KMS_KES_CERT_FILE.

The private key associated with the MINIO_KMS_KES_CERT_FILE X.509 certificate to use when authenticating to the KES server. The KES server requires clients to present their certificate for performing mutual TLS (mTLS).

The x.509 certificate to present to the KES server. The KES server requires clients to present their certificate for performing mutual TLS (mTLS).

The KES server computes an identity from the certificate and compares it to its configured policies. The KES server grants the MinIO server access to only those operations explicitly granted by the policy.

The password that decrypts the private key in MINIO_KMS_KES_KEY_FILE. Set this variable only if that private key is encrypted.

The path to a file or directory of Certificate Authority certificates. The object store uses them to verify the certificate the KES server presents.

The name of an external key on the Key Management system (KMS) configured on the KES server and used for performing en/decryption operations. MinIO uses this key for the following:

• Encrypting backend data ( IAM, server configuration).
• The default encryption key for Server-Side Encryption with SSE-KMS.
• The encryption key for Server-Side Encryption with SSE-S3.

Set these variables in the shell from which you run the kes command.

Each variable has an older KES_* spelling that the client still honors. The client reads the MINIO_KES_* name first and falls back to the older name only if the canonical name is unset. Use the canonical names in new work.

The server endpoint a client uses to connect to KES. If not defined, the value defaults to 127.0.0.1:7373.

The legacy spelling is KES_SERVER.

The API key a client uses to authenticate to the KES server.

The legacy spelling is KES_API_KEY.

The path to the private key the client presents when authenticating to KES with mutual TLS (mTLS). Pair it with MINIO_KES_CERT_FILE. Use this pair when the KES server authenticates clients by certificate rather than by API key.

The legacy spelling is KES_CLIENT_KEY.

The path to the X.509 certificate the client presents when authenticating to KES with mutual TLS (mTLS). Pair it with MINIO_KES_KEY_FILE.

The legacy spelling is KES_CLIENT_CERT.