Add KMS master key from Docker secret (#7825)

Lucas committed 7 years ago

Commit ea66a521 parent 55dd0175 files · +40 −4Browse files

Unified · Split

5 files

Dockerfile +2 −1
Dockerfile.dev +2 −1
Dockerfile.release +2 −1
dockerscripts/docker-entrypoint.sh +14 −0
docs/kms/README.md +20 −1

@@ -16,7 +16,8 @@ FROM alpine:3.9 · 15 unmodified lines
16		16
17	ENV MINIO_UPDATE off	17	ENV MINIO_UPDATE off
18	ENV MINIO_ACCESS_KEY_FILE=access_key \	18	ENV MINIO_ACCESS_KEY_FILE=access_key \
19	MINIO_SECRET_KEY_FILE=secret_key	19	MINIO_SECRET_KEY_FILE=secret_key \
		20	MINIO_SSE_MASTER_KEY_FILE=sse_master_key
20		21
21	EXPOSE 9000	22	EXPOSE 9000
22		23

Dockerfile.dev+2−1

@@ -7,7 +7,8 @@ COPY minio /usr/bin/ · 6 unmodified lines
7		7
8	ENV MINIO_UPDATE off	8	ENV MINIO_UPDATE off
9	ENV MINIO_ACCESS_KEY_FILE=access_key \	9	ENV MINIO_ACCESS_KEY_FILE=access_key \
10	MINIO_SECRET_KEY_FILE=secret_key	10	MINIO_SECRET_KEY_FILE=secret_key \
		11	MINIO_SSE_MASTER_KEY_FILE=sse_master_key
11		12
12	RUN \	13	RUN \
13	apk add --no-cache ca-certificates 'curl>7.61.0' 'su-exec>=0.2' && \	14	apk add --no-cache ca-certificates 'curl>7.61.0' 'su-exec>=0.2' && \

Dockerfile.release+2−1

@@ -18,7 +18,8 @@ COPY dockerscripts/docker-entrypoint.sh /usr/bin/ · 17 unmodified lines
18		18
19	ENV MINIO_UPDATE off	19	ENV MINIO_UPDATE off
20	ENV MINIO_ACCESS_KEY_FILE=access_key \	20	ENV MINIO_ACCESS_KEY_FILE=access_key \
21	MINIO_SECRET_KEY_FILE=secret_key	21	MINIO_SECRET_KEY_FILE=secret_key \
		22	MINIO_SSE_MASTER_KEY_FILE=sse_master_key
22		23
23	RUN \	24	RUN \
24	apk add --no-cache ca-certificates 'curl>7.61.0' 'su-exec>=0.2' && \	25	apk add --no-cache ca-certificates 'curl>7.61.0' 'su-exec>=0.2' && \

dockerscripts/docker-entrypoint.sh+14−0

@@ -39,6 +39,17 @@ docker_secrets_env() { · 38 unmodified lines
39	fi	39	fi
40	}	40	}
41		41
		42	## Set SSE_MASTER_KEY from docker secrets if provided
		43	docker_sse_encryption_env() {
		44	SSE_MASTER_KEY_FILE="/run/secrets/$MINIO_SSE_MASTER_KEY_FILE"
		45
		46	if [ -f "$SSE_MASTER_KEY_FILE" ]; then
		47	MINIO_SSE_MASTER_KEY="$(cat "$SSE_MASTER_KEY_FILE")"
		48	export MINIO_SSE_MASTER_KEY
		49
		50	fi
		51	}
		52
42	# su-exec to requested user, if service cannot run exec will fail.	53	# su-exec to requested user, if service cannot run exec will fail.
43	docker_switch_user() {	54	docker_switch_user() {
44	if [ -z "${MINIO_USERNAME}" ] \|\| [ -z "${MINIO_GROUPNAME}" ]; then	55	if [ -z "${MINIO_USERNAME}" ] \|\| [ -z "${MINIO_GROUPNAME}" ]; then
@@ -55,5 +66,8 @@ docker_switch_user() { · 10 unmodified lines
55	## Set access env from secrets if necessary.	66	## Set access env from secrets if necessary.
56	docker_secrets_env	67	docker_secrets_env
57		68
		69	## Set sse encryption from secrets if necessary.
		70	docker_sse_encryption_env
		71
58	## Switch to user if applicable.	72	## Switch to user if applicable.
59	docker_switch_user "$@"	73	docker_switch_user "$@"

docs/kms/README.md+20−1

    by enabling or disabling the corresponding master keys on demand.
 - Direct KMS master keys:
-   MinIO can also be configured to directly use a master key specified by the environment variable `MINIO_SSE_MASTER_KEY`.
+   MinIO can also be configured to directly use a master key specified by the environment variable `MINIO_SSE_MASTER_KEY` or with a docker secret key.
    Direct master keys are useful if the storage backend is not on the same machine as the MinIO server, e.g.,
    if network drives or MinIO gateway is used and an external KMS would cause too much management overhead.
 #### 2.2 Specify a master key
+**2.2.1 KMS master key from environment variables**
 A KMS master key consists of a master-key ID (CMK) and the 256 bit master key encoded as HEX value separated by a `:`.
 A KMS master key can be specified directly using:
 head -c 32 /dev/urandom | xxd -c 32 -ps
 ```
+**2.2.2 KMS master key from docker secret**
+Alternatively, you may pass a master key as a [Docker secret](https://docs.docker.com/engine/swarm/secrets/).
+```bash
+echo "my-minio-key:6368616e676520746869732070617373776f726420746f206120736563726574" | docker secret create sse_master_key
+```
+Obviously, do not use this demo key for anything real!
+To use another secret name, follow the instructions above and replace sse_master_key with your custom names (e.g. my_sse_master_key).
+Then, set the MINIO_SSE_MASTER_KEY_FILE environment variable to your secret name:
+```bash
+export MINIO_SSE_MASTER_KEY_FILE=my_sse_master_key
+```
 ### 3. Test your setup
 To test this setup, start minio server with environment variables set in Step 3, and server is ready to handle SSE-S3 requests.

Add KMS master key from Docker secret (#7825)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code