This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

The pages in this section document settings for configuring AIStor to work with identity and access management (IAM) solutions. There is a page of settings for each of the IAM methods AIStor supports. Active Directory / LDAP OpenID Connect MinIO Identity Management Plugin MinIO Access Management Plugin

This page documents settings for enabling external identity management using the MinIO Identity Management Plugin. See MinIO External Identity Management Plugin for a tutorial on using these settings. You can establish or modify settings by defining: an environment variable on the host system prior to starting or restarting the AIStor Server. Refer to your operating system’s documentation for how to define an environment variable. a configuration setting using mc admin config set. If you define both an environment variable and the similar configuration setting, AIStor uses the environment variable value.

The mc support perf object command measures the S3 performance of reading and writing objects in a cluster. AIStor autotunes concurrency to obtain maximum throughput and IOPS (Input/Output Per Second). Use this command to identify potential S3 API performance bottlenecks in your deployment. Syntax Example The following command measures the performance of S3 read/write of an object on the alias myaistor.

The following page includes the full contents of the AIStor Custom Resource Definition V1 (Stable) CustomResourceDefinition. API Reference Packages aistor.min.io/v1 aistor.min.io/v1 Package v1 - This page provides a quick automatically generated reference for the AIStor ObjectStore Operator aistor.min.io/v1 CRD.

The following page includes the full contents of the AIStor Custom Resource Definition V1 (Alpha) CustomResourceDefinition. API Reference Packages aistor.min.io/v1alpha1 aistor.min.io/v1alpha1 Package v1alpha1 is the v1alpha1 version of the Enterprise Operator API.

The AIStor Security Token Service (STS) AssumeRoleWithWebIdentity API endpoint generates temporary access credentials using a JSON Web Token (JWT) returned from a configured OIDC Identity Provider (IDP). This page documents the AIStor Server AssumeRoleWithWebIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, refer to the documentation for that SDK. The AIStor STS AssumeRoleWithWebIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the AIStor-specific syntax and links out to the AWS reference for all shared elements.

This section provides guidance around recommended hardware configurations in production AIStor Server deployments. Hardware recommendations The recommendations below reflect our experience with assisting enterprise customers in deploying on a variety of IT infrastructures while maintaining the desired SLA/SLO. Use the recommended configurations below as a guideline for the physical or virtual hosts supporting the AIStor Server deployment. Use the Erasure Code Calculator to provide baseline guidance for the number of hosts and drives necessary to meet your storage and availability requirements.

AIStor can make the loss of an entire site, while significant, a relatively minor incident. Site recovery depends on the replication option you use for the site. Replication type Restoration method Site Replication Total restoration of IAM configurations, bucket configurations, and data from the healthy peer site(s) Bucket Replication Data restoration of objects and metadata from a healthy remote location for each bucket configured for replication mc mirror Data restoration of objects only from a healthy remote location with no versioning Site replication healing automatically adds IAM settings, buckets, bucket configurations, and objects from the existing site(s) to the new site with no further action required.

AIStor Server supports publishing bucket notification events to an Elasticsearch service endpoint. Prerequisites Elasticsearch v7.0 or later. AIStor relies on the v7 project for Elastic connectivity. The elastic/v7 library specifically targets Elasticsearch v7.0 and is not compatible with earlier Elasticsearch versions. The AIStor mc command line tool.