Feng Ruohang
c46b16ec62
The transitional references land in one commit, because they are only correct together: the repository is pgsty/silo, its default branch is main, and nothing in the tree should point a user at the old names. Changed: - Workflow branch filters. go.yml and vulncheck.yml gated on `branches: master` for both push and pull_request, so renaming the default branch would have taken automatic CI offline with no error and no signal - the workflows would simply never trigger again. They now name main. - Release target. goreleaser's `release.github.name` becomes silo, which is what actually decides where a tagged build publishes. sign-release-rpms.sh's GH_REPO default follows. - The OCI `image.source` label, the Helm chart `sources` entry, the security advisory link in the issue-template config, and the go.mod comment citing the LDAP TLS fix. - 115 occurrences across README, README_ZH, SECURITY, CONTRIBUTING and 30 docs pages, including 72 links that also carried the master branch in their path. Those matter most: GitHub redirects clone, fetch, push and web URLs after a rename, but raw.githubusercontent.com does not, and neither follows a branch rename - every one of those links would 404 twice over. - Three error strings in cmd/erasure-sets.go, cmd/storage-errors.go and internal/config/errors.go that print an issue URL to operators. These are Go string literals inside rebrand-guard's brand allowlist, so the baseline is regenerated. The regeneration removes exactly those three entries and adds none; all twelve other protected sets, including the 9014 exported symbols, are byte-identical. - The transitional-naming disclaimers in README, README_ZH, SECURITY and CONTRIBUTING are dropped, since they no longer describe anything. Deliberately unchanged, all three because they exist to reject or freeze the old name rather than to point at it: - buildscripts/minio-upgrade.sh pins pgsty/minio@sha256:b6bfe72... - the frozen pre-rebrand image is the control group for the MinIO-to-Silo upgrade test. - helm-migration-guard rejects any rendered container still pulling pgsty/minio. - verify-rebrand.sh rejects the same in the delivery surfaces. Also unchanged: docs/config/README.md links to pgsty/mc/blob/master, and that repository's default branch really is still master. It moves when mc does. verify-rebrand.sh gains three assertions so this cannot silently regress: no source reference may name pgsty/minio outside the three allowlisted guards, no link may target pgsty/silo's master branch, and go.yml and vulncheck.yml must filter on main. Both new rejections were negative-tested - reintroducing a master branch filter and adding a pgsty/minio URL each fail the gate with the specific message. This commit assumes the rename actually happens. Until the GitHub branch and repository renames are executed, the links it introduces do not resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
5.3 KiB
KMS IAM/Config Encryption
Silo supports encrypting config, IAM assets with KMS provided keys. If the KMS is not enabled, Silo will store the config, IAM data as plain text erasure coded in its backend.
Silo KMS Quick Start
Silo supports two ways of encrypting IAM and configuration data.
You can either use KES - together with an external KMS - or, much simpler,
set the env. variable MINIO_KMS_SECRET_KEY and start/restart the Silo server. For more details about KES and how
to set it up refer to our KMS Guide.
Instead of configuring an external KMS you can start with a single key by
setting the env. variable MINIO_KMS_SECRET_KEY. It expects the following
format:
MINIO_KMS_SECRET_KEY=<key-name>:<base64-value>
First generate a 256 bit random key via:
$ cat /dev/urandom | head -c 32 | base64 -
OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
Now, you can set MINIO_KMS_SECRET_KEY like this:
export MINIO_KMS_SECRET_KEY=my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
You can choose an arbitrary name for the key - instead of
my-minio-key. Please note that losing theMINIO_KMS_SECRET_KEYwill cause data loss since you will not be able to decrypt the IAM/configuration data anymore. For distributed Silo deployments, specify the sameMINIO_KMS_SECRET_KEYfor each Silo server process.
At any point in time you can switch from MINIO_KMS_SECRET_KEY to a full KMS
deployment. You just need to import the generated key into KES - for example via
the KES CLI once you have successfully setup KES:
kes key create my-minio-key OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw=
-
For instructions on setting up KES, see the KES Getting Started guide
-
For instructions on using KES for encrypting the Silo backend, follow the KMS Quick Start. The SSE-S3 configuration setup also supports Silo KMS backend encryption.
FAQ
Why is this change needed?
Before, there were two separate mechanisms - S3 objects got encrypted using a KMS, if present, and the IAM / configuration data got encrypted with the root credentials. Now, Silo encrypts IAM / configuration and S3 objects with a KMS, if present. This change unified the key-management aspect within Silo.
The unified KMS-based approach has several advantages:
- Key management is now centralized. There is one way to change or rotate encryption keys. There used to be two different mechanisms - one for regular S3 objects and one for IAM data.
- Reduced server startup time. For IAM encryption with the root credentials, Silo had to use a memory-hard function (Argon2) that (on purpose) consumes a lot of memory and CPU. The new KMS-based approach can use a key derivation function that is orders of magnitudes cheaper w.r.t. memory and CPU.
- Root credentials can now be changed easily. Before, a two-step process was required to change the cluster root credentials since they were used to en/decrypt the IAM data. So, both - the old and new credentials - had to be present at the same time during a rotation and the old credentials had to be removed once the rotation completed. This process is now gone. The root credentials can now be changed easily.
Does this mean I need an enterprise KMS setup to run Silo (securely)?
No, Silo does not depend on any third-party KMS provider. You have three options here:
- Run Silo without a KMS. In this case all IAM data will be stored in plain-text.
- Run Silo with a single secret key. Silo supports a static cryptographic key that can act as minimal KMS. With this method all IAM data will be stored encrypted. The encryption key has to be passed as environment variable.
- Run Silo with KES (minio/kes) in combination with any supported KMS as secure key store. For example, you can run Silo + KES + Hashicorp Vault.
What about an exiting Silo deployment? Can I just upgrade my cluster?
Yes, Silo will try to transparently migrate any existing IAM data and either stores it in plaintext (no KMS) or re-encrypts using the KMS.
Is this change backward compatible? Will it break my setup?
This change is not backward compatible for all setups. In particular, the native Hashicorp Vault integration - which has been deprecated already - won't be supported anymore. KES is now mandatory if a third-party KMS should be used.
Further, since the configuration data is encrypted with the KMS, the KMS
configuration itself can no longer be stored in the Silo config file and
instead must be provided via environment variables. If you have set your KMS
configuration using e.g. the mc admin config commands you will need to adjust
your deployment.
Even though this change is backward compatible we do not expect that it affects the vast majority of deployments in any negative way.
Will an upgrade of an existing Silo cluster impact the SLA of the cluster or will it even cause downtime?
No, an upgrade should not cause any downtime. However, on the first startup - since Silo will attempt to migrate any existing IAM data - the boot process may take slightly longer, but may not be visibly noticeable. Once the migration has completed, any subsequent restart should be as fast as before or even faster.