• Stars
    star
    441
  • Rank 95,062 (Top 2 %)
  • Language
    Go
  • License
    GNU Affero Genera...
  • Created over 4 years ago
  • Updated about 2 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Key Managament Server for Object Storage and more


KES is a cloud-native distributed key management and encryption server designed to secure modern applications at scale.

What is KES?

KES is a distributed key management server that scales horizontally. It can either be run as edge server close to the applications reducing latency to and load on a central key management system (KMS) or as central key management server. Edge servers are self-contained stateless nodes close to the application that can be scaled up/down automatically. Central KES servers or clusters are stateful systems that store and manage cryptographic keys and secrets securely.

Install

The KES server and CLI is available as a single binary, container image or can be build from source.

Homebrew
brew install minio/stable/kes
Docker

Pull the latest release via:

docker pull minio/kes
Binary Releases
OS ARCH Binary
Linux amd64 linux-amd64
Linux arm64 linux-arm64
Linux ppc64le linux-ppc64le
Linux s390x linux-s390x
Apple M1 arm64 darwin-arm64
Apple amd64 darwin-amd64
Windows amd64 windows-amd64

You can also verify the binary with minisign by downloading the corresponding .minisig signature file. Then run:

minisign -Vm kes-<OS>-<ARCH> -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
Build from source

Download and install the binary via your Go toolchain:

go install github.com/minio/kes/cmd/kes@latest

Quick Start

We run a public KES instance at https://play.min.io:7373 for you to experiment with. You can interact with our play instance either via the KES CLI or cURL. Alternatively, you can get started by setting up your own KES server in less than five minutes.

CLI

1. Configure CLI

We point the KES CLI to the KES server at https://play.min.io:7373 and use the following API key:

export KES_SERVER=https://play.min.io:7373
export KES_API_KEY=kes:v1:AD9E7FSYWrMD+VjhI6q545cYT9YOyFxZb7UnjEepYDRc

3. Create a Key

Next, we can create a new root encryption key - e.g. my-key.

kes key create my-key

Note that creating a new key will fail with key already exist if it already exist.

4. Generate a DEK

Now, you can use that key to derive a new data encryption keys (DEK).

kes key dek my-key

The plaintext part of the DEK would be used by an application to encrypt some data. The ciphertext part of the DEK would be stored alongside the encrypted data for future decryption.

Server

For a quickstart setup take a look at our FS guide. For further references checkout our list of key store guides.

cURL

1. Fetch Admin Credentials

As an initial step, you will need to download the private key and certificate to authenticate to the KES server as the admin.

curl -sSL --tlsv1.2 \
   -O 'https://raw.githubusercontent.com/minio/kes/master/root.key' \
   -O 'https://raw.githubusercontent.com/minio/kes/master/root.cert'

2. Create a Key

Next, we can create a new root encryption key - e.g. my-key.

curl -sSL --tlsv1.3 \
    --key root.key \
    --cert root.cert \
    -X POST 'https://play.min.io:7373/v1/key/create/my-key'

Note that creating a new key will fail with key already exist if it already exist.

3. Generate a DEK

Now, you can use that key to derive a new data encryption keys (DEK).

curl -sSL --tlsv1.3 \
    --key root.key \
    --cert root.cert \
    --data '{}' \
    -X POST 'https://play.min.io:7373/v1/key/generate/my-key'

The plaintext part of the DEK would be used by an application to encrypt some data. The ciphertext part of the DEK would be stored alongside the encrypted data for future decryption.

4. Further References

For a comprehensive list of REST API endpoints refer to the KES API overview.

Docs

If you want to learn more about KES checkout our documentation.

FAQs

I have received an insufficient permissions error

This means that you are using a KES identity that is not allowed to perform a specific operation, like creating or listing keys.

The KES admin identity can perform any general purpose API operation. You should never experience a not authorized: insufficient permissions error when performing general purpose API operations using the admin identity.

In addition to the admin identity, KES supports a policy-based access control model. You will receive a not authorized: insufficient permissions error in the following two cases:

  1. You are using a KES identity that is not assigned to any policy. KES rejects requests issued by unknown identities.

    This can be fixed by assigning a policy to the identity. Checkout the examples.

  2. You are using a KES identity that is assigned to a policy but the policy either not allows or even denies the API call.

    In this case, you have to grant the API permission in the policy assigned to the identity. Checkout the list of APIs. For example, when you want to create a key you should allow the /v1/key/create/<key-name>. The <key-name> can either be a specific key name, like my-key-1 or a pattern allowing arbitrary key names, like my-key*.

    Also note that deny rules take precedence over allow rules. Hence, you have to make sure that any deny pattern does not accidentally matches your API request.


License

Use of KES is governed by the AGPLv3 license that can be found in the LICENSE file.

More Repositories

1

minio

The Object Store for AI Data Infrastructure
Go
43,034
star
2

mc

Simple | Fast tool to manage MinIO clusters ☁️
Go
2,683
star
3

minio-go

MinIO Go client SDK for S3 compatible object storage
Go
2,204
star
4

simdjson-go

Golang port of simdjson: parsing gigabytes of JSON per second
Go
1,730
star
5

c2goasm

C to Go Assembly
Go
1,296
star
6

operator

Simple Kubernetes Operator for MinIO clusters 💻
Go
1,092
star
7

minio-java

MinIO Client SDK for Java
Java
995
star
8

sha256-simd

Accelerate SHA256 computations in pure Go using AVX512, SHA Extensions for x86 and ARM64 for ARM. On AVX512 it provides an up to 8x improvement (over 3 GB/s per core). SHA Extensions give a performance boost of close to 4x over native.
Go
919
star
9

minio-js

MinIO Client SDK for Javascript
JavaScript
879
star
10

highwayhash

Native Go version of HighwayHash with optimized assembly implementations on Intel and ARM. Able to process over 10 GB/sec on a single core on Intel CPUs - https://en.wikipedia.org/wiki/HighwayHash
Go
850
star
11

console

Simple UI for MinIO Object Storage 🧮
TypeScript
788
star
12

minio-py

MinIO Client SDK for Python
Python
758
star
13

awesome-minio

A curated list of Awesome MinIO community projects.
658
star
14

selfupdate

Build self-updating Go programs
Go
583
star
15

docs

MinIO Object Storage Documentation
SCSS
532
star
16

directpv

Simple Kubernetes CSI driver for Direct Attached Storage 💽
Go
517
star
17

sidekick

High Performance HTTP Sidecar Load Balancer
Go
515
star
18

minio-dotnet

MinIO Client SDK for .NET
C#
506
star
19

warp

S3 benchmarking tool
Go
463
star
20

minfs

A network filesystem client to connect to MinIO and Amazon S3 compatible cloud storage servers
Go
451
star
21

dsync

A distributed sync package.
Go
399
star
22

doctor

Doctor is a documentation server for your docs in github
Ruby
389
star
23

minsql

High-performance log search engine.
Rust
358
star
24

minio-service

Collection of MinIO server scripts for upstart, systemd, sysvinit, launchd.
Shell
345
star
25

sio

Go implementation of the Data At Rest Encryption (DARE) format.
Go
340
star
26

blake2b-simd

Fast hashing using pure Go implementation of BLAKE2b with SIMD instructions
Go
245
star
27

concert

Concert is a console based certificate generation tool for https://letsencrypt.org.
Go
195
star
28

minio-rs

MinIO Rust SDK for Amazon S3 Compatible Cloud Storage
Rust
169
star
29

asm2plan9s

Tool to generate BYTE sequences for Go assembly as generated by YASM
Go
165
star
30

md5-simd

Accelerate aggregated MD5 hashing performance up to 8x for AVX512 and 4x for AVX2. Useful for server applications that need to compute many MD5 sums in parallel.
Go
159
star
31

certgen

A dead simple tool to generate self signed certificates for MinIO TLS deployments
Go
104
star
32

thumbnailer

A thumbnail generator example using Minio's listenBucketNotification API
JavaScript
103
star
33

charts

MinIO Helm Charts
Mustache
98
star
34

spark-select

A library for Spark DataFrame using MinIO Select API
Scala
97
star
35

minio-cpp

MinIO C++ Client SDK for Amazon S3 Compatible Cloud Storage
C++
92
star
36

mint

Collection of tests to detect overall correctness of MinIO server.
Go
76
star
37

madmin-go

The MinIO Admin Go Client SDK provides APIs to manage MinIO services
Go
65
star
38

minio-java-rest-example

REST example using minio-java library.
Java
62
star
39

minio-go-media-player

A HTML5 media player using minio-go library.
HTML
57
star
40

minio-js-store-app

Store Application using minio-js library to manage product assets
HTML
49
star
41

minio-hs

MinIO Client SDK for Haskell
Haskell
46
star
42

dperf

Drive performance measurement tool
Go
46
star
43

msf

MFS (Minio Federation Service) is a namespace, identity and access management server for Minio Servers
Go
43
star
44

openlake

Build Data Lake using Open Source tools
Jupyter Notebook
39
star
45

zipindex

Package for indexing zip files and storing a compressed index
Go
39
star
46

hperf

Distributed HTTP Speed Test.
Go
38
star
47

simdcsv

Go
33
star
48

nifi-minio

A custom ContentRepository implementation for NiFi to persist data to MinIO Object Storage
Java
30
star
49

benchmarks

Collection of benchmarks captured for MinIO server.
29
star
50

m3

MinIO Kubernetes Cloud
Go
27
star
51

android-photo-app

Android Photo App example using minio-java library.
Java
26
star
52

minio-ruby

MinIO Client SDK for Ruby
Ruby
26
star
53

lxmin

Backup and Restore LXC instances from MinIO
Go
26
star
54

radio

Redundant Array of Distributed Independent Objectstores in short RADIO performs synchronous mirroring, erasure coding across multiple object stores
Go
24
star
55

parquet-go

Go library to work with Parquet Files
Go
23
star
56

presto-minio

How to use Presto (with Hive metastore) and MinIO?
23
star
57

pkg

Repository to hold all the common packages imported by MinIO projects
Go
22
star
58

bottlenet

Find bottlenecks in distributed network
Go
21
star
59

lsync

Local syncing package with support for timeouts. This package offers both a sync.Mutex and sync.RWMutex compatible interface.
Go
17
star
60

simple-ci

Stateless. Infinite scalability. Easy Setup. Microservice. Minimalist CI
JavaScript
17
star
61

ming

Object Storage Gateway for Hybrid Cloud
Go
17
star
62

blog-assets

Collection of assets used for various articles at https://blogs.min.io
Jupyter Notebook
17
star
63

gluegun

Glues Github markdown docs to present a beautiful documentation site.
CSS
16
star
64

swift-photo-app

Swift photo app
Swift
15
star
65

homebrew-stable

Homebrew tap for MinIO
Ruby
15
star
66

mnm

Minimal Minio API aggregates many minio instances to look like one
Go
13
star
67

perftest

Collection of scripts used in Minio performance testing.
Go
12
star
68

ror-resumeuploader-app

Ruby on rails app using aws-sdk-ruby
JavaScript
11
star
69

mds

MinIO Design System is a common library of all the UI design elements.
TypeScript
10
star
70

minio-iam-testing

Shell
10
star
71

rsync-go

This is a pure go implementation of the rsync algorithm with highwayhash signature
Go
9
star
72

select-simd

Go
8
star
73

chaos

A framework for testing Minio's fault tolerance capability.
Go
8
star
74

hdfs-to-minio

A simple containerized hadoop CLI to migrate content between various HCFS implementations
Dockerfile
7
star
75

simdjson-fuzz

Fuzzers and corpus for https://github.com/minio/simdjson-go
Go
7
star
76

minio-lambda-notification-example

Example App that uses MinIO Lambda Notification with Postgres
JavaScript
7
star
77

buzz

A prototype for github issue workflow management
Less
7
star
78

dmt

Direct MinIO Tunnel
Go
6
star
79

go-cv

Golang wrapper for https://github.com/ermig1979/Simd
Go
6
star
80

spark-data-generator

Generates dummy parquet, csv, json files for testing and validating MinIO compatibility
Scala
6
star
81

kms-go

MinIO key managment SDK
Go
6
star
82

xxml

Package xml implements a simple XML 1.0 parser that understands XML name spaces, extended support for control characters.
Go
5
star
83

spark-streaming-checkpoint

Spark Streaming Checkpoint File Manager for MinIO
Scala
5
star
84

minio-jenkins

This is a simple Jenkins plugin that lets you upload Jenkins artifacts to a Minio Server
Java
5
star
85

disco

Disco discovery service for MinIO.
Go
5
star
86

docs-k8s

MinIO Docs for Kubernetes
Python
4
star
87

attic

Collection of deprecated packages 😟
C++
4
star
88

pkger

Debian, RPMs and APKs for MinIO
Go
4
star
89

marketplace

Makefile
4
star
90

kitchensink

Go
3
star
91

confess

Object store consistency checker
Go
3
star
92

webhook

HTTP events to file logger
Go
3
star
93

colorjson

Package json implements encoding and decoding of JSON as defined in RFC 7159. The mapping between JSON and Go values is described in the documentation for the Marshal and Unmarshal functions
Go
2
star
94

minio-pcf-adapter

MinIO Service Adapter for Pivotal
Go
2
star
95

training

Materials for supporting MinIO-led training and curriculum.
Python
2
star
96

docs-vsphere

MinIO Docs for VMware Cloud Foundation
Python
2
star
97

xfile

Determines information about the object.
Go
2
star
98

wiki

MinIO's Wiki
2
star
99

hcp-to-minio

About A simple CLI to migrate content from HCP to MinIO
Go
2
star
100

csvparser

Package csv reads and writes comma-separated values (CSV) files.
Go
2
star