turn on default encryption for minio #251

New issue

Open

opened 2023-10-29 12:21:47 +00:00 by jessebot · 4 comments

jessebot commented

2023-10-29 12:21:47 +00:00

(Migrated from github.com)

minio has oidc in front of the tenant, but encryption is not enabled by default yet. We should do that before next major release

cloudymax commented

2023-10-29 20:56:27 +00:00

(Migrated from github.com)

We will need to write a function to enable SSE-C encryption on a per-bucket basis to run a few mc commands. Unfortunately we can't add any KMS other than vault or a major cloud 😕

https://min.io/docs/minio/linux/administration/server-side-encryption/server-side-encryption-sse-c.html

We will need to write a function to enable SSE-C encryption on a per-bucket basis to run a few mc commands. Unfortunately we can't add any KMS other than vault or a major cloud 😕 https://min.io/docs/minio/linux/administration/server-side-encryption/server-side-encryption-sse-c.html

😕 1

jessebot commented

2023-10-31 07:31:19 +00:00

(Migrated from github.com)

oof, well, that shouldn't be the worst thing in the world. I wish OpenTofu would do something about Vault as well.

cloudymax commented

2023-11-25 09:58:34 +00:00

(Migrated from github.com)

So for this issue, there's no way we can do what we want to do without using Vault or a non FOSS keyvault. Since weve gotten encryption up and running on Seaweedfs I think we can close this with the acknowledgement that if users want encryption by default, seaweedfs is the way to go.

cloudymax commented

2023-11-25 09:59:31 +00:00

(Migrated from github.com)

Keeping open to re-evaluate of SSE-C in the vanilla helm chart

👍 1