Add KMS master key from Docker secret (#7825)

Lucas committed 7 years ago

Commit ea66a521 parent 55dd0175 files · +40 −4Browse files

Unified · Split

5 files

Dockerfile +2 −1
Dockerfile.dev +2 −1
Dockerfile.release +2 −1
dockerscripts/docker-entrypoint.sh +14 −0
docs/kms/README.md +20 −1

@@ -16,7 +16,8 @@ FROM alpine:3.9 · 15 unmodified lines
16	16
17	17	ENV MINIO_UPDATE off
18	18	ENV MINIO_ACCESS_KEY_FILE=access_key \
19		− MINIO_SECRET_KEY_FILE=secret_key
	19	+ MINIO_SECRET_KEY_FILE=secret_key \
	20	+ MINIO_SSE_MASTER_KEY_FILE=sse_master_key
20	21
21	22	EXPOSE 9000
22	23

Dockerfile.dev+2−1

@@ -7,7 +7,8 @@ COPY minio /usr/bin/ · 6 unmodified lines
7	7
8	8	ENV MINIO_UPDATE off
9	9	ENV MINIO_ACCESS_KEY_FILE=access_key \
10		− MINIO_SECRET_KEY_FILE=secret_key
	10	+ MINIO_SECRET_KEY_FILE=secret_key \
	11	+ MINIO_SSE_MASTER_KEY_FILE=sse_master_key
11	12
12	13	RUN \
13	14	apk add --no-cache ca-certificates 'curl>7.61.0' 'su-exec>=0.2' && \

Dockerfile.release+2−1

@@ -18,7 +18,8 @@ COPY dockerscripts/docker-entrypoint.sh /usr/bin/ · 17 unmodified lines
18	18
19	19	ENV MINIO_UPDATE off
20	20	ENV MINIO_ACCESS_KEY_FILE=access_key \
21		− MINIO_SECRET_KEY_FILE=secret_key
	21	+ MINIO_SECRET_KEY_FILE=secret_key \
	22	+ MINIO_SSE_MASTER_KEY_FILE=sse_master_key
22	23
23	24	RUN \
24	25	apk add --no-cache ca-certificates 'curl>7.61.0' 'su-exec>=0.2' && \

dockerscripts/docker-entrypoint.sh+14−0

@@ -39,6 +39,17 @@ docker_secrets_env() { · 38 unmodified lines
39	39	fi
40	40	}
41	41
	42	+## Set SSE_MASTER_KEY from docker secrets if provided
	43	+docker_sse_encryption_env() {
	44	+ SSE_MASTER_KEY_FILE="/run/secrets/$MINIO_SSE_MASTER_KEY_FILE"
	45	+
	46	+ if [ -f "$SSE_MASTER_KEY_FILE" ]; then
	47	+ MINIO_SSE_MASTER_KEY="$(cat "$SSE_MASTER_KEY_FILE")"
	48	+ export MINIO_SSE_MASTER_KEY
	49	+
	50	+ fi
	51	+}
	52	+
42	53	# su-exec to requested user, if service cannot run exec will fail.
43	54	docker_switch_user() {
44	55	if [ -z "${MINIO_USERNAME}" ] \|\| [ -z "${MINIO_GROUPNAME}" ]; then
@@ -55,5 +66,8 @@ docker_switch_user() { · 10 unmodified lines
55	66	## Set access env from secrets if necessary.
56	67	docker_secrets_env
57	68
	69	+## Set sse encryption from secrets if necessary.
	70	+docker_sse_encryption_env
	71	+
58	72	## Switch to user if applicable.
59	73	docker_switch_user "$@"

docs/kms/README.md+20−1

@@ -12,7 +12,7 @@ MinIO supports two different KMS concepts: · 11 unmodified lines
12	12	by enabling or disabling the corresponding master keys on demand.
13	13
14	14	- Direct KMS master keys:
15		− MinIO can also be configured to directly use a master key specified by the environment variable `MINIO_SSE_MASTER_KEY`.
	15	+ MinIO can also be configured to directly use a master key specified by the environment variable `MINIO_SSE_MASTER_KEY` or with a docker secret key.
16	16	Direct master keys are useful if the storage backend is not on the same machine as the MinIO server, e.g.,
17	17	if network drives or MinIO gateway is used and an external KMS would cause too much management overhead.
18	18
@@ -215,6 +215,8 @@ minio gateway s3 · 196 unmodified lines
215	215
216	216	#### 2.2 Specify a master key
217	217
	218	+2.2.1 KMS master key from environment variables
	219	+
218	220	A KMS master key consists of a master-key ID (CMK) and the 256 bit master key encoded as HEX value separated by a `:`.
219	221	A KMS master key can be specified directly using:
220	222
@@ -228,6 +230,23 @@ Please use your own master key. A random master key can be generated using e.g. · 7 unmodified lines
228	230	head -c 32 /dev/urandom \| xxd -c 32 -ps
229	231	```
230	232
	233	+2.2.2 KMS master key from docker secret
	234	+
	235	+Alternatively, you may pass a master key as a [Docker secret](https://docs.docker.com/engine/swarm/secrets/).
	236	+
	237	+```bash
	238	+echo "my-minio-key:6368616e676520746869732070617373776f726420746f206120736563726574" \| docker secret create sse_master_key
	239	+```
	240	+
	241	+Obviously, do not use this demo key for anything real!
	242	+
	243	+To use another secret name, follow the instructions above and replace sse_master_key with your custom names (e.g. my_sse_master_key).
	244	+Then, set the MINIO_SSE_MASTER_KEY_FILE environment variable to your secret name:
	245	+
	246	+```bash
	247	+export MINIO_SSE_MASTER_KEY_FILE=my_sse_master_key
	248	+```
	249	+
231	250	### 3. Test your setup
232	251	To test this setup, start minio server with environment variables set in Step 3, and server is ready to handle SSE-S3 requests.
233	252

Add KMS master key from Docker secret (#7825)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code