AIStor Key Manager controls access through a combination of Enclaves and Identities. Enclaves An Enclave is an isolated namespace in which Key Manager stores cryptographic keys. A single Key Manager instance can have multiple enclaves, where a user with access to one enclave cannot perform operations on another.

Overview Remove a secret name from the KES server. Once removed, the secret is no longer valid for the KES server. Syntax kes secret rm \ <name> \ [--insecure, -k] Parameters name Required

Installation The following instructions install the minkms binary to your local host machine. You can use this binary for running Key Manager locally or connecting to an existing Key Manager deployment to perform management operations. Linux AMD64 curl --progress-bar --retry 10 -L https://dl.min.io/aistor/minkms/release/linux-amd64/minkms -o minkms chmod +x ./minkms mv ./minkms /usr/local/bin/ Linux ARM64 curl --progress-bar --retry 10 -L https://dl.min.io/aistor/minkms/release/linux-arm64/minkms -o minkms chmod +x ./minkms mv ./minkms /usr/local/bin/ macOS M-series (ARM64) curl --progress-bar --retry 10 -L https://dl.min.io/aistor/minkms/release/darwin-arm64/minkms -o minkms chmod +x ./minkms mv ./minkms /usr/local/bin/ Once installed, set the following environment variables to allow the minkms process to communicate with the remote Key Manager server:

Key Manager provides the following API endpoints for monitoring deployment health, status, and performance: API Description Auth /version Returns the version of the Key Manager node. Public /v1/health/live Returns 200OK for liveness checks. Public /v1/health/ready Returns 200OK for operational readiness checks. Public /v1/health/metrics Returns Prometheus-compatible metrics for scraping mTLS Authentication

Overview Outputs the name, date, and creation information for a specified policy. The output resembles the following: Name my-app Date 2023-03-07 17:17:05 Created by 3ecfcdf38fcbe141ae26a1030f81e96b753365a46760ae6b578698a97c59fd22 Syntax kes policy info \ <name> \ [--color <string>] \ [--insecure, -k] \ [--json] Parameters name Required

Overview Output server metrics. The output resembles the following: Request OK [2xx] Err [4xx] Err [5xx] Req/s Latency 9231 14603 0 0.00 13ms 38.73% 61.27% 0.00% System UpTime Heap Stack CPUs Threads 142h40m3s 3.1MB 1.0MB 4 19 Syntax kes metric \ [--insecure, -k] \ [--rate] Parameters --insecure, -k Optional

The following page includes the full contents of the AIStor Custom Resource Definition V1 (Alpha) CustomResourceDefinition. The KeyManagerSpec spec provides the specification for Key Manager resources. API Reference Packages aistor.min.io/v1alpha1 aistor.min.io/v1alpha1 Package v1alpha1 is the v1alpha1 version of the Enterprise Operator API.

Description Uncordon drives to make them available for Volume Manager to schedule. Syntax kubectl directpv uncordon [DRIVE ...] [flags] Parameters Flags Flag Description --all Select all drives -d, --drives <string> Select drives by given names. Optionally, supports ellipsis expansion pattern, such as sd{a...z}. --dry-run Do a test run of the command without making any actual changes. -n, --nodes <string> Select drives from given nodes. Optionally, supports ellipsis expansion pattern, such as node{1...10}. --status <string> Select drives by status. Valid statuses include error, lost, moving, ready, or removed. Global Flags Flag Description --kubeconfig <string> Path to the kube.config file to use for CLI requests --quiet Suppress printing error messages Examples Uncordon all drives from all nodes The following command marks all cordoned drives in the cluster as available for scheduling.

Description Move volumes from one drive to another drive within a node (excluding data) Syntax kubectl directpv move SRC-DRIVE DEST-DRIVE [flags] Aliases You can use the following command to perform the same functions as kubectl directpv move

Description Resume suspended volumes. Syntax directpv resume volumes [VOLUME ...] [flags] Parameters Flags Flag Description -n, --nodes <string> Resume volumes from specified node(s). Use ellipsis expansion notation, such as node{1...10}. -d, --drives <string> Resume volumes by given names. Use ellipsis expansion notation, such as sd{a...z}. --pod-names <string> Resume volumes by given pod(s). Use ellipsis expansion notation, such as minio-{0...4}. --pod-namespaces <string> Resume volumes by given namespace(s). Use ellipsis expansion notation, such as tenant-{0...3}. --dry-run See the results of the command without making any actual changes to drives. Global Flags Flag Description --kubeconfig <string> Path to the kube.config file to use for CLI requests --quiet Suppress printing error messages Examples Resume all volumes from a node kubectl directpv resume volumes --nodes=node1 Resume specific volume from specific node kubectl directpv resume volumes --nodes=node1 --volumes=sda Resume a volume by name kubectl directpv resume volumes pvc-0700b8c7-85b2-4894-b83a-274484f220d0