AIStor Key Manager AIStor Key Manager is a robust key management server (KMS) designed to store cryptographic keys. K...

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

AIStor Key Manager supports installation on to Linux and Kubernetes infrastructures. Hardware and host configuration The following table lists the minimum requirements for a Key Manager server CPU Single-Socket Server-grade CPU with support for AES-NI instruction sets. Memory 8GiB available Storage 10GiB SSD or NVMe Network 10GbE low-latency interface Security standards typically discourage storing encryption keys on the same hosts as the encrypted data. As such, consider deploying Key Manager onto physical or virtual hosts that are fully separated or independent from the AIStor Object Store clusters they support.

AIStor Key Manager supports installation on Linux hosts running AMD64 or ARM64 architectures. This procedure downloads and installs the Key Manager onto a single host machine. You can then expand the cluster with additional nodes to increase availability and resiliency. For production environments, ensure a minimum of 3 key manager hosts. Procedure The commands in this procedure may require sudo permissions to succeed depending on the level of access you have when accessing the host machine. If you do not have sudo or similar permissions, contact your systems administrator for assistance with completing the steps in this procedure.

MinIO Key Encryption Service This site provides information about MinIO ’s Key Encryption Service (KES) project. The ...

Overview Create a new KES identity. You cannot add identities to a stateless KES implementation with this command. Instead, define the identities for stateless implementations in the config file. The output of the command resembles the following:

This page documents the installation of the AIStor Key Encryption Service. You may require root or sudo permissions to perform some of the steps. Install the AIStor KES binary on each node in your KES cluster. Linux AMD64 curl --progress-bar --retry 10 -L https://dl.min.io/aistor/kes/release/linux-amd64/kes -o kes chmod +x ./kes mv ./kes /usr/local/bin/kes kes --version ARM64

This Quickstart shows you how to setup a local KES server that stores keys in-memory. Not permanent The in-memory key store will lose all state on restarts. It should only be used for testing purposes. K E S C l i e n t K E S S e r v e r I n - M e m o r y Quickstart Development Mode For a quick development test server, use

AIStor Volume Manager This set of pages describes Volume Manager, a Container Storage Interface (CSI) for direct atta...