astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-07-20 20:50:22 +03:00
Code Issues Packages Projects Releases Wiki Activity

Final changes to config sub-system (#8600)

Browse Source 
- Introduces changes such as certain types of
  errors that can be ignored or which need to 
  go into safe mode.
- Update help text as per the review
This commit is contained in:
Harshavardhana
2019-12-04 15:32:37 -08:00
committed by kannappanr
parent 794eb54da8
commit c9940d8c3f
65 changed files with 605 additions and 1033 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/crypto/config.go
+7 -18
View File
@@ -46,10 +46,6 @@ const (
// DefaultKVS - default KV crypto config
var (
DefaultKVS = config.KVS{
config.KV{
Key: config.State,
Value: config.StateOff,
},
config.KV{
Key: KMSVaultEndpoint,
Value: "",
@@ -100,9 +96,6 @@ const (
)
const (
// EnvKMSVaultState to enable on/off
EnvKMSVaultState = "MINIO_KMS_VAULT_STATE"
// EnvKMSVaultEndpoint is the environment variable used to specify
// the vault HTTPS endpoint.
EnvKMSVaultEndpoint = "MINIO_KMS_VAULT_ENDPOINT"
@@ -145,6 +138,12 @@ var defaultCfg = VaultConfig{
},
}
// Enabled returns if HashiCorp Vault is enabled.
func Enabled(kvs config.KVS) bool {
endpoint := kvs.Get(KMSVaultEndpoint)
return endpoint != ""
}
// LookupConfig extracts the KMS configuration provided by environment
// variables and merge them with the provided KMS configuration. The
// merging follows the following rules:
@@ -167,7 +166,7 @@ func LookupConfig(kvs config.KVS) (KMSConfig, error) {
return kmsCfg, err
}
if !kmsCfg.AutoEncryption {
kmsCfg.AutoEncryption, err = config.ParseBool(env.Get(EnvKMSAutoEncryption, config.StateOff))
kmsCfg.AutoEncryption, err = config.ParseBool(env.Get(EnvKMSAutoEncryption, config.EnableOff))
if err != nil {
return kmsCfg, err
}
@@ -176,16 +175,6 @@ func LookupConfig(kvs config.KVS) (KMSConfig, error) {
return kmsCfg, nil
}
stateBool, err := config.ParseBool(env.Get(EnvKMSVaultState, kvs.Get(config.State)))
if err != nil {
if kvs.Empty() {
return kmsCfg, nil
}
return kmsCfg, err
}
if !stateBool {
return kmsCfg, nil
}
vcfg := VaultConfig{
Auth: VaultAuth{
Type: "approle",
cmd/crypto/help.go
+8 -8
View File
@@ -23,32 +23,32 @@ var (
Help = config.HelpKVS{
config.HelpKV{
Key: KMSVaultEndpoint,
Description: `Points to Vault API endpoint eg: "http://vault-endpoint-ip:8200"`,
Description: `HashiCorp Vault API endpoint e.g. "http://vault-endpoint-ip:8200"`,
Type: "url",
},
config.HelpKV{
Key: KMSVaultKeyName,
Description: `Transit key name used in vault policy, must be unique name eg: "my-minio-key"`,
Description: `transit key name used in vault policy, must be unique name e.g. "my-minio-key"`,
Type: "string",
},
config.HelpKV{
Key: KMSVaultAuthType,
Description: `Authentication type to Vault API endpoint eg: "approle"`,
Description: `authentication type to Vault API endpoint e.g. "approle"`,
Type: "string",
},
config.HelpKV{
Key: KMSVaultAppRoleID,
Description: `Unique role ID created for AppRole`,
Description: `unique role ID created for AppRole`,
Type: "string",
},
config.HelpKV{
Key: KMSVaultAppRoleSecret,
Description: `Unique secret ID created for AppRole`,
Description: `unique secret ID created for AppRole`,
Type: "string",
},
config.HelpKV{
Key: KMSVaultNamespace,
Description: `Only needed if AppRole engine is scoped to Vault Namespace eg: "ns1"`,
Description: `only needed if AppRole engine is scoped to Vault Namespace e.g. "ns1"`,
Optional: true,
Type: "string",
},
@@ -60,13 +60,13 @@ var (
},
config.HelpKV{
Key: KMSVaultCAPath,
Description: `Path to PEM-encoded CA cert files to use mTLS authentication (optional) eg: "/home/user/custom-certs"`,
Description: `path to PEM-encoded CA cert files to use mTLS authentication (optional) e.g. "/home/user/custom-certs"`,
Optional: true,
Type: "path",
},
config.HelpKV{
Key: config.Comment,
Description: "A comment to describe the KMS Vault setting",
Description: config.DefaultComment,
Optional: true,
Type: "sentence",
},
cmd/crypto/legacy.go
+1 -16
View File
@@ -83,10 +83,6 @@ func SetKMSConfig(s config.Config, cfg KMSConfig) {
return
}
s[config.KmsVaultSubSys][config.Default] = config.KVS{
config.KV{
Key: config.State,
Value: config.StateOn,
},
config.KV{
Key: KMSVaultEndpoint,
Value: cfg.Vault.Endpoint,
@@ -141,7 +137,7 @@ func SetKMSConfig(s config.Config, cfg KMSConfig) {
// It sets the global KMS configuration according to the merged configuration
// on success.
func lookupConfigLegacy(kvs config.KVS) (KMSConfig, error) {
autoBool, err := config.ParseBool(env.Get(EnvAutoEncryptionLegacy, config.StateOff))
autoBool, err := config.ParseBool(env.Get(EnvAutoEncryptionLegacy, config.EnableOff))
if err != nil {
return KMSConfig{}, err
}
@@ -155,17 +151,6 @@ func lookupConfigLegacy(kvs config.KVS) (KMSConfig, error) {
},
}
// Assume default as "on" for legacy config since we didn't have a _STATE
// flag to turn it off, but we should honor it nonetheless to turn it off
// if the vault endpoint is down and there is no way to start the server.
stateBool, err := config.ParseBool(env.Get(EnvKMSVaultState, config.StateOn))
if err != nil {
return cfg, err
}
if !stateBool {
return cfg, nil
}
endpointStr := env.Get(EnvLegacyVaultEndpoint, "")
if endpointStr != "" {
// Lookup Hashicorp-Vault configuration & overwrite config entry if ENV var is present