Feng Ruohang
c46b16ec62
The transitional references land in one commit, because they are only correct together: the repository is pgsty/silo, its default branch is main, and nothing in the tree should point a user at the old names. Changed: - Workflow branch filters. go.yml and vulncheck.yml gated on `branches: master` for both push and pull_request, so renaming the default branch would have taken automatic CI offline with no error and no signal - the workflows would simply never trigger again. They now name main. - Release target. goreleaser's `release.github.name` becomes silo, which is what actually decides where a tagged build publishes. sign-release-rpms.sh's GH_REPO default follows. - The OCI `image.source` label, the Helm chart `sources` entry, the security advisory link in the issue-template config, and the go.mod comment citing the LDAP TLS fix. - 115 occurrences across README, README_ZH, SECURITY, CONTRIBUTING and 30 docs pages, including 72 links that also carried the master branch in their path. Those matter most: GitHub redirects clone, fetch, push and web URLs after a rename, but raw.githubusercontent.com does not, and neither follows a branch rename - every one of those links would 404 twice over. - Three error strings in cmd/erasure-sets.go, cmd/storage-errors.go and internal/config/errors.go that print an issue URL to operators. These are Go string literals inside rebrand-guard's brand allowlist, so the baseline is regenerated. The regeneration removes exactly those three entries and adds none; all twelve other protected sets, including the 9014 exported symbols, are byte-identical. - The transitional-naming disclaimers in README, README_ZH, SECURITY and CONTRIBUTING are dropped, since they no longer describe anything. Deliberately unchanged, all three because they exist to reject or freeze the old name rather than to point at it: - buildscripts/minio-upgrade.sh pins pgsty/minio@sha256:b6bfe72... - the frozen pre-rebrand image is the control group for the MinIO-to-Silo upgrade test. - helm-migration-guard rejects any rendered container still pulling pgsty/minio. - verify-rebrand.sh rejects the same in the delivery surfaces. Also unchanged: docs/config/README.md links to pgsty/mc/blob/master, and that repository's default branch really is still master. It moves when mc does. verify-rebrand.sh gains three assertions so this cannot silently regress: no source reference may name pgsty/minio outside the three allowlisted guards, no link may target pgsty/silo's master branch, and go.yml and vulncheck.yml must filter on main. Both new rejections were negative-tested - reintroducing a master branch filter and adding a pgsty/minio URL each fail the gate with the specific message. This commit assumes the rename actually happens. Until the GitHub branch and repository renames are executed, the links it introduces do not resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
KMS Guide
Silo uses a key-management-system (KMS) to support SSE-S3. If a client requests SSE-S3, or auto-encryption is enabled, the Silo server encrypts each object with a unique object key which is protected by a master key managed by the KMS.
Quick Start
Silo supports KMS integration through a KES-compatible endpoint. Deploy and control your own KES instance, create a dedicated client identity and key, and then configure Silo with the compatibility environment variables below. Do not use a public or shared KES instance for real data.
1. Set the Silo-to-KES configuration
export MINIO_KMS_KES_ENDPOINT=https://kes.example.com:7373
export MINIO_KMS_KES_KEY_FILE=/etc/silo/kes/client.key
export MINIO_KMS_KES_CERT_FILE=/etc/silo/kes/client.crt
export MINIO_KMS_KES_KEY_NAME=silo-default-key
2. Start the Silo server
export MINIO_ROOT_USER=minio
export MINIO_ROOT_PASSWORD=silo123
silo server ~/export
The certificate, private key, KES policy, and named key must be provisioned by the administrator. Protect the client private key and use TLS verification in every environment.
Configuration Guides
A typical Silo deployment that uses a KMS for SSE-S3 looks like this:
┌────────────┐
│ ┌──────────┴─┬─────╮ ┌────────────┐
└─┤ ┌──────────┴─┬───┴──────────┤ ┌──────────┴─┬─────────────────╮
└─┤ ┌──────────┴─┬─────┬──────┴─┤ KES Server ├─────────────────┤
└─┤ Silo ├─────╯ └────────────┘ ┌────┴────┐
└────────────┘ │ KMS │
└─────────┘
In a given setup, there are n Silo instances talking to m KES servers but only 1 central KMS. The most simple setup consists of 1 Silo server or cluster talking to 1 KMS via 1 KES server.
The main difference between various Silo-KMS deployments is the KMS implementation. The following table helps you select the right option for your use case:
| KMS | Purpose |
|---|---|
| Hashicorp Vault | Local KMS. Silo and KMS on-prem (Recommended) |
| AWS-KMS + SecretsManager | Cloud KMS. Silo in combination with a managed KMS installation |
| Gemalto KeySecure /Thales CipherTrust | Local KMS. Silo and KMS On-Premises. |
| Google Cloud Platform SecretManager | Cloud KMS. Silo in combination with a managed KMS installation |
| FS | Local testing or development (Not recommended for production) |
The Silo-to-KES configuration is the same regardless of the KMS implementation. Consult the KES project documentation for the selected keystore.
Further references
- Run Silo with TLS / HTTPS
- Tweak the KES server configuration
- Run a load balancer in front of KES
- Understand the KES server concepts
Auto Encryption
Auto-Encryption is useful when Silo administrator wants to ensure that all data stored on Silo is encrypted at rest.
Using mc encrypt (recommended)
Silo automatically encrypts all objects on buckets if KMS is successfully configured and bucket encryption configuration is enabled for each bucket as shown below:
mc encrypt set sse-s3 mysilo/bucket/
Verify if Silo has sse-s3 enabled
mc encrypt info mysilo/bucket/
Auto encryption 'sse-s3' is enabled
Using environment (not-recommended)
Silo automatically encrypts all objects on buckets if KMS is successfully configured and following ENV is enabled:
export MINIO_KMS_AUTO_ENCRYPTION=on
Verify auto-encryption
Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends e.g. SSE-C headers, Silo will encrypt the object with the key sent by the client and won't reach out to the configured KMS.
To verify auto-encryption, use the following mc command:
mc cp test.file mysilo/bucket/
test.file: 5 B / 5 B ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ 100.00% 337 B/s 0s
mc stat mysilo/bucket/test.file
Name : test.file
...
Encrypted :
X-Amz-Server-Side-Encryption: AES256
Encrypted Private Key
Silo supports encrypted KES client private keys. Therefore, you can use
an password-protected private keys for MINIO_KMS_KES_KEY_FILE.
When using password-protected private keys for accessing KES you need to provide the password via:
export MINIO_KMS_KES_KEY_PASSWORD=<your-password>
Note that Silo only supports encrypted private keys - not encrypted certificates. Certificates are no secrets and sent in plaintext as part of the TLS handshake.