Entrust KeyControl is a proprietary KMS which KES supports using for storing secrets. K E S C l i e n t K E S S e r v e r E n t r u s t K e y C o n t r o l Prerequisites This procedure was written and tested against Entrust KeyControl v10.1. The provided instructions may work against other KeyControl versions. This procedure assumes you have prior experience with Entrust products and have followed their documentation, best practices, and other published materials in deploying the KeyControl service.

AIStor Key Manager supports installation on Linux hosts running AMD64 or ARM64 architectures. This procedure downloads and installs the Key Manager onto a single host machine. You can then expand the cluster with additional nodes to increase availability and resiliency. For production environments, ensure a minimum of 3 key manager hosts. Procedure The commands in this procedure may require sudo permissions to succeed depending on the level of access you have when accessing the host machine. If you do not have sudo or similar permissions, contact your systems administrator for assistance with completing the steps in this procedure.

The mc support top command returns statistics for distributed AIStor Object Store deployments, similar to the output of the top command in a shell. mc support top requires distributed topologies. The command has the following syntax: mc support top COMMAND [COMMAND FLAGS] [ARGUMENTS ...] Subcommands Subcommand Description api Summarize real-time S3 API events on a deployment. disk Display current drive usage and performance statistics. locks List the ten oldest object locks, including age, type, owner, and resource. net Display real-time network metrics for the deployment. rpc Display metrics for remote procedure calls (RPC), with interactive sorting options.

The mc support top locks command lists the ten oldest locks on an AIStor deployment. The command outputs the age of the lock, type of lock, owner, and resource. The output resembles the following: Since Type Owner Resource 13 hours ago WRITE 10.68.100.18:9000 .minio.sys/leader.lock 13 hours ago WRITE 10.68.100.18:9000 .minio.sys/callhome/runCallhome.lock 13 hours ago WRITE 10.68.100.23:9000 .minio.sys/new-drive-healing/0/0 Syntax Example The following command displays the current in-progress S3 API calls on the alias myaistor.

This Quickstart shows you how to setup a local KES server that stores keys in-memory. Not permanent The in-memory key store will lose all state on restarts. It should only be used for testing purposes. K E S C l i e n t K E S S e r v e r I n - M e m o r y Quickstart Development Mode For a quick development test server, use

The mc admin accesskey enable command enables an existing access key. The command requires the access key to exist and be currently disabled. Syntax Example The following command enables the access key myuseraccesskey on the myaistor deployment:

The AIStor Client (mc) is a drop-in replacement for the Open Source MinIO client. AIStor mc has exclusive functionality intended to support licensed AIStor Server deployments. mc has the following syntax: mc [GLOBALFLAGS] COMMAND --help See Command quick reference for a list of supported commands. Command name Some operating systems bundle another software tool that uses mc as its command name. In those cases, the AIStor Client uses the command mcli instead. Swap mcli in for mc in all reference documentation if this is your situation.

AIStor supports publishing bucket notification events to a webhook service endpoint. Prerequisites The AIStor mc command line tool This procedure uses the mc command line tool for certain actions. See the mc Quickstart for installation instructions. Add a webhook endpoint to an AIStor Server The following procedure adds a new webhook service endpoint for supporting bucket notifications in an AIStor Server.

AIStor supports decommissioning and removing server pools from a deployment with two or more pools. To decommission, there must be at least one remaining pool with sufficient available space to receive the objects from the decommissioned pools. AIStor supports queueing multiple pools in a single decommission command. Each listed pool immediately enters a read-only status, but draining occurs one pool at a time. Decommissioning is designed for removing an older server pool whose hardware is no longer sufficient or performant compared to the pools in the deployment. AIStor automatically migrates data from the decommissioned pools to the remaining pools in the deployment based on the ratio of free space available in each pool.

Syntax The mc admin decommission command starts the decommissioning process for an AIStor server pools. Decommissioning is designed for removing an older server pool whose hardware is no longer sufficient or performant compared to the pools in the deployment. AIStor automatically migrates data from the decommissioned pool to the remaining pools in the deployment based on the ratio of free space available in each pool. The process ignores unreadable objects, such as those that have lost read quorum, and continues with remaining objects in the pool.