Overview The kes key command creates, utilizes, displays, and deletes cryptographic keys (Secrets) through the AIStor Key Encryption Service (KES). KES stores created secrets on the configured Key Management System (KMS) target. You can also use these commands to encrypt/decrypt messages or generate new data encryption keys.

Installation The following instructions install the minkms binary to your local host machine. You can use this binary for running Key Manager locally or connecting to an existing Key Manager deployment to perform management operations. Linux AMD64 curl --progress-bar --retry 10 -L https://dl.min.io/aistor/minkms/release/linux-amd64/minkms -o minkms chmod +x ./minkms mv ./minkms /usr/local/bin/ Linux ARM64 curl --progress-bar --retry 10 -L https://dl.min.io/aistor/minkms/release/linux-arm64/minkms -o minkms chmod +x ./minkms mv ./minkms /usr/local/bin/ macOS M-series (ARM64) curl --progress-bar --retry 10 -L https://dl.min.io/aistor/minkms/release/darwin-arm64/minkms -o minkms chmod +x ./minkms mv ./minkms /usr/local/bin/ Once installed, set the following environment variables to allow the minkms process to communicate with the remote Key Manager server:

Overview Output server metrics. The output resembles the following: Request OK [2xx] Err [4xx] Err [5xx] Req/s Latency 9231 14603 0 0.00 13ms 38.73% 61.27% 0.00% System UpTime Heap Stack CPUs Threads 142h40m3s 3.1MB 1.0MB 4 19 Syntax kes metric \ [--insecure, -k] \ [--rate] Parameters --insecure, -k Optional

Entrust KeyControl is a proprietary KMS which KES supports using for storing secrets. K E S C l i e n t K E S S e r v e r E n t r u s t K e y C o n t r o l Prerequisites This procedure was written and tested against Entrust KeyControl v10.1. The provided instructions may work against other KeyControl versions. This procedure assumes you have prior experience with Entrust products and have followed their documentation, best practices, and other published materials in deploying the KeyControl service.

AIStor Key Manager supports installation onto Upstream Kubernetes and Red Hat OpenShift infrastructures. The Upstream instructions work for any Kubernetes flavor that maintains a strict implementation of the native Kubernetes API and behaviors.

The following page includes the full contents of the AIStor Custom Resource Definition V1 (Alpha) CustomResourceDefinition. The KeyManagerSpec spec provides the specification for Key Manager resources. API Reference Packages aistor.min.io/v1alpha1 aistor.min.io/v1alpha1 Package v1alpha1 is the v1alpha1 version of the Enterprise Operator API.

Overview Remove a secret name from the KES server. Once removed, the secret is no longer valid for the KES server. Syntax kes secret rm \ <name> \ [--insecure, -k] Parameters name Required

Overview Outputs the name, date, and creation information for a specified policy. The output resembles the following: Name my-app Date 2023-03-07 17:17:05 Created by 3ecfcdf38fcbe141ae26a1030f81e96b753365a46760ae6b578698a97c59fd22 Syntax kes policy info \ <name> \ [--color <string>] \ [--insecure, -k] \ [--json] Parameters name Required

AIStor Key Manager controls access through a combination of Enclaves and Identities. Enclaves An Enclave is an isolated namespace in which Key Manager stores cryptographic keys. A single Key Manager instance can have multiple enclaves, where a user with access to one enclave cannot perform operations on another.

Key Manager provides the following API endpoints for monitoring deployment health, status, and performance: API Description Auth /version Returns the version of the Key Manager node. Public /v1/health/live Returns 200OK for liveness checks. Public /v1/health/ready Returns 200OK for operational readiness checks. Public /v1/health/metrics Returns Prometheus-compatible metrics for scraping mTLS Authentication