The KMS decouples MinIO as an application-facing storage system from the secure key storage and

```

Observe that all MinIO clusters only have a connection to "their own" KES instance and no direct access to Vault (as one possible KMS implementation).

Each KES instance will handle all encrypton/decryption requests made by "its" MinIO cluster such that the central KMS implementation does not have to handle

a lot of traffic. Instead, each KES instance will use the central KMS implementation as secure key store and fetches the required master keys from it.

Install MinIO, KES and Vault. For MinIO take a look at the [MinIO quickstart guide](https://docs.min.io/docs/minio-quickstart-guide).

for your OS and platform.

To generate a new private key for Vault's certificate run the following openssl command:

openssl ecparam -genkey -name prime256v1 | openssl ec -out vault-tls.key

Then generate a new TLS certificate for the private/public key pair via:

To generate a new private key for KES's certificate run the following openssl command:

openssl ecparam -genkey -name prime256v1 | openssl ec -out kes-tls.key

Then generate a new TLS certificate for the private/public key pair via:

On unix-like systems, Vault uses the `mlock` syscall to prevent the OS from writing in-memory data

to disk (swapping). Therefore, you should give the Vault executable the ability to use the `mlock`

syscall without running the process as root. To do so run:

sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault))

Then create the Vault config file:

cat > vault-config.json <<EOF

Finally, start the Vault server via:

vault server -config vault-config.json

```

In a separate terminal window set the `VAULT_ADDR` env. variable to your Vault server:

export VAULT_ADDR='https://127.0.0.1:8200'

by your machine - e.g. Let's Encrypt - then you don't need to run this command.

Then initialize Vault via:

vault operator init

```

Now, set the env. variable `VAULT_TOKEN` to the root token printed by the command before:

export VAULT_TOKEN=s.zaU4Gbcu0Wh46uj2V3VuUde0

Then use any of the previously generated key shares to unseal Vault.

vault operator unseal eyW/+8ZtsgT81Cb0e8OVxzJAQP5lY7Dcamnze+JnWEDT

vault operator unseal 0tZn+7QQCxphpHwTm6/dC3LpP5JGIbYl6PK8Sy79R+P2

vault operator unseal cmhs+AUMXUuB6Lzsvgcbp3bRT6VDGQjgCBwB2xm0ANeF

The cryptographic master keys (but not the object encryption keys) will be stored

at Vault. Therefore, we need to enable Vault's K/V backend. To do so run:

vault secrets enable kv

Since we want connect one/multiple KES server to Vault later, we have to enable

AppRole authentication. To do so run:

vault auth enable approle

The following policy determines how an application (i.e. KES server) can interact

with Vault.

cat > minio-kes-policy.hcl <<EOF

Then we upload the policy to Vault:

vault policy write minio-key-policy ./minio-kes-policy.hcl

and secret ID and is only allowed to perform operations granted by the specific policy.

So, we first create a new role for our KES server:

vault write auth/approle/role/kes-role token_num_uses=0 secret_id_num_uses=0 period=5m

Then we bind a policy to the role:

vault write auth/approle/role/kes-role policies=minio-key-policy

Finally, we request an AppRole role ID and secret ID from Vault.

First, the role ID:

vault read auth/approle/role/kes-role/role-id

Then the secret ID:

vault write -f auth/approle/role/kes-role/secret-id

Similar to Vault, KES uses the `mlock` syscall on linux systems to prevent the OS from writing in-memory

data to disk (swapping). Therefore, you should give the KES executable the ability to use the `mlock`

syscall without running the process as root. To do so run:

sudo setcap cap_ipc_lock=+ep $(readlink -f $(which kes))

Therefore, each MinIO cluster needs a X.509 TLS certificate for client authentication. You can create a

(self-signed) certificate by running:

kes tool identity new MinIO --key=minio.key --cert=minio.cert --time=8760h

To get the identity of a X.509 certificate run:

kes tool identity of minio.cert

```

Now, we can create the KES config file and start the KES server.

Finally, start the KES server via: