Entrust KeyControl is a proprietary KMS which KES supports using for storing secrets. K E S C l i e n t K E S S e r v e r E n t r u s t K e y C o n t r o l Prerequisites This procedure was written and tested against Entrust KeyControl v10.1. The provided instructions may work against other KeyControl versions. This procedure assumes you have prior experience with Entrust products and have followed their documentation, best practices, and other published materials in deploying the KeyControl service.

The AIStor Security Token Service (STS) APIs allow applications to generate temporary credentials for accessing the AIStor Server. The STS API is required for AIStor Servers configured to use external identity managers, as the API allows conversion of the external IDP credentials into AWS Signature v4-compatible credentials. STS API endpoints AIStor supports the following STS API endpoints:

Operations

AIStor Key Manager supports installation on Linux hosts running AMD64 or ARM64 architectures. This procedure downloads and installs the Key Manager onto a single host machine. You can then expand the cluster with additional nodes to increase availability and resiliency. For production environments, ensure a minimum of 3 key manager hosts. Procedure The commands in this procedure may require sudo permissions to succeed depending on the level of access you have when accessing the host machine. If you do not have sudo or similar permissions, contact your systems administrator for assistance with completing the steps in this procedure.

1701

Overview Volume Manager provisions drives for pods that provide a PersistentVolumeClaim for the Volume Manager storage class. Volume Manager includes a storage class named directpv-min-io with volume binding mode WaitForFirstConsumer. This mode delays volume binding and provisioning of a PersistentVolume until the creation of a Pod using the PersistentVolumeClaim. Volume Manager then selects or provisions PersistentVolumes that match the topology specified in the Pod’s scheduling constraints.

Prerequisites Working Volume Manager plugin. To install the plugin, refer to the plugin installation guide. Working Volume Manager CSI driver in Kubernetes. To install the driver, refer to the driver installation guide. Added drives in Volume Manager. Refer to the drive management guide.

Driver Specification CSIDriver Key Value name directpv-min-io fsGroupPolicy ReadWriteOnceWithFSType requiresRepublish false podInfoOnMount true attachRequired false storageCapacity false modes Persistent, Ephemeral StorageClass Key Value name directpv-min-io provisioner directpv-min-io reclaimPolicy Delete allowVolumeExpansion true volumeBindingMode WaitForFirstConsumer Volume ManagerDrives CRD Key Value name directpvdrives apigroup directpv.min.io Volume ManagerVolumes CRD Key Value name directpvvolumes apigroup directpv.min.io Volume ManagerNodes CRD Key Value name directpvnodes apigroup directpv.min.io Volume ManagerInitRequests CRD Key Value name directpvinitrequests apigroup directpv.min.io Driver Role Based Access Control (RBAC) apiGroup Resources Verbs (core) endpoints get, list, watch, create, update, delete (core) events list, watch, create, update, patch (core) nodes get, list, watch (core) persistentvolumes get, list, watch, create, delete (core) persistentvolumeclaims get, list, watch, update (core) pods,pod get, list, watch policy podsecuritypolicies use apiextensions.k8s.io customresourcedefinitions get, list, watch, create, update, delete coordination.k8s.io leases get, list, watch, update, delete, create directpv.min.io directpvdrives get, list, watch, create, update, delete directpv.min.io directpvvolumes get, list, watch, create, update, delete directpv.min.io directpvnodes get, list, watch, create, update, delete directpv.min.io directpvinitrequests get, list, watch, create, update, delete snapshot.storage.k8s.io volumesnapshotcontents get, list snapshot.storage.k8s.io volumesnapshots get, list storage.k8s.io csinodes get, list, watch storage.k8s.io storageclasses get, list, watch storage.k8s.io volumeattachments get, list, watch The service account bound to the above clusterrole is directpv-min-io in the directpv namespace and the corresponding clusterrolebinding is directpv-min-io

Prerequisites Working Volume Manager plugin. To install the plugin, refer to the plugin installation guide. Working Volume Manager CSI driver in Kubernetes. To install the driver, refer to the driver installation guide. Drives Add drives Volume Manager must have access to drives to provision volumes. This involves a two step process:

Prerequisites Working Volume Manager plugin To install the plugin, refer to the plugin installation guide. Working Volume Manager CSI driver in Kubernetes To install the driver, refer to the driver installation guide. Add node Add a node to the Volume Manager DaemonSet, then run the discover command.