This page documents migration of encryption keys from the legacy MinIO Key Encryption Service (KES) to AIStor Key Manager. Key Manager holds all cryptographic keys in an encrypted format without relying on an external keystore. Once you complete this operation, you can switch your AIStor deployments to use Key Manager for supporting Server Side Encryption operations. Migration of cryptographic keys is a critical operation that can lead to data loss if performed incorrectly. Before proceeding, you must do the following:

Overview Manage KES secrets. Subcommands Subcommands Description create Create a new secret info Get information about a secret ls List secrets rm Remove a secret show Display a secret

Overview The kes server command starts a MinIO Key Encryption Server (KES) server. The kes server handles requests for creating and retrieving cryptography keys from a supported Key Management System (KMS). KES is a required component for enabling Server-Side Object Encryption in AIStor Object Stores using a 3rd party KMS solution.

Monitoring Guidelines Volume Manager nodes export Prometheus compatible metrics data via port 10443. To scrape data in Prometheus, each node must be accessible by port 10443. Make node server metrics port accessible by localhost:8080. kubectl -n directpv port-forward node-server-4nd6q 8080:10443 Add the following to your Prometheus configuration:

Overview Volume provisioning involves making a PersistentVolumeClaim using default directpv-min-io storage class or a custom storage class having a directpv-min-io provisioner. The storage classes come with volume binding mode WaitForFirstConsumer. This mode delays volume binding and provisioning of a PersistentVolume until a Pod using the PersistentVolumeClaim is created.

Description Show overall information about the Volume Manager installation in the cluster Syntax directpv info [flags] Parameters Global Flags You can use the following global Volume Manager flags with kubectl directpv info:

AIStor Key Manager supports installation on to Linux and Kubernetes infrastructures. Key Manager Requires TLS Encryption Key Manager requires using TLS for all connections to ensure complete security of transmitted cryptographic data. For production environments, generate certificates signed by a trusted or managed Certificate Authority. If the CA is internal, private, or otherwise not typically included in a Global Trust List, the full chain of CA certificates must be available for facilitating TLS validation.

Overview Import a cryptographic key. Syntax kes key import \ <name> \ <key> \ [--insecure, -k] Parameters name Required

Description Cordoning drives makes them unschedulable. Volume Manager does not schedule volumes on drives that have been cordoned. Use kubectl directpv uncordon to make cordoned drives accessible for scheduling again. Syntax kubectl directpv cordon [DRIVE ...] [flags] Parameters kubectl directpv cordon requires a way to define the drive(s) to cordon. The command does not require any specific parameter. All parameters are optional, as long as you include a way to select one or more drives in the command.

Updating Custom Installations Custom installations do not support client-side upgrade functionality. Use kubectl directpv migrate to migrate the old resources to a new installation. Pod Security Policies Kubernetes deprecated the PodSecurityPolicy feature in v1.21, then removed it entirely in v1.25. Use Pod Security Admission as a replacement, as recommended in the Kubernetes documentation.