10.2.7

Edit

Migrate from Vault KMS to Cloud-based KMS

IA Cloud Enterprise uses internal Vault as KMS for Minio encryption by default. For more information, see Configure KMS server for MinIO encryption.

The following guide describes how to switch KMS after the installation.

note

The guide assumes that:

  • Your installer is in the /opt/workfusion/wf_installer directory.
  • IA Cloud is installed in the /opt/workfusion directory.
  • All steps are executed once on the MASTER1 server.

Modify Vault policy

important

Skip this step if you have IA Cloud 10.2.8 or newer.

To modify the Vault policy, do the following:

  1. Read the configuration, set environment variables, and fetch a root token.

    $ eval $(cat /opt/workfusion/supervisord/apps/minio.ini | grep MINIO_ETCD_ENDPOINTS)
$ eval $(cat /opt/workfusion/tools/get-vault-secret.sh | grep check_url=)

$ export VAULT_ROOT_TOKEN=$(/opt/workfusion/etcd/etcdctl --endpoints $MINIO_ETCD_ENDPOINTS --cacert=/opt/workfusion/ssl/mtls-auth-ca.crt --cert=/opt/workfusion/ssl/mtls-auth.crt --key=/opt/workfusion/ssl/mtls-auth.key get --print-value-only vault-init-keys | jq -r .root_token)

  2. Check the existing vault policy for KES:

    $ curl --header "X-Vault-Token: ${VAULT_ROOT_TOKEN}" $check_url/v1/sys/policy/kes_policy | jq

  3. Modify the existing vault policy for KES:

    $ curl --request POST --header "X-Vault-Token: ${VAULT_ROOT_TOKEN}" \
    --data '{"policy":"path \"kv/minio_kes/*\" {capabilities=[\"create\",\"read\",\"delete\",\"list\"]}\n "}' \
    $check_url/v1/sys/policy/kes_policy

  4. Check the modified vault policy for KES.

    $ curl --header "X-Vault-Token: ${VAULT_ROOT_TOKEN}" $check_url/v1/sys/policy/kes_policy | jq

    Now the policy has the additional "list" capability.

Backup old KES configuration

To back up the old KES configuration, run the command:

$ cp /opt/workfusion/kes/server-config.yml /opt/workfusion/kes/server-config.yml.backup

Migrate to cloud-based KMS

AWS SecretsManager

note

For the Multi-point installation, execute steps 2 and 3 on all Master servers.

To migrate the configuration to AWS SecretsManager, do the following:

  1. Prepare the cloud infrastructure as described in the guide.

  2. In the config.yml file, specify the following parameters:

    $ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config master

# vault_kes_kms_provider=false
# aws_kes_kms_provider=true
# aws_secretsmanager_region: 'set real value here'
# aws_secretsmanager_access_key: 'set real value here'
# aws_secretsmanager_secret_key: 'set real value here'

  3. Apply the new configuration:

    $ ./install.sh configure kes

  4. Migrate the configuration to AWS SecretsManager:

    $ export VAULT_TOKEN=$(get-vault-token.sh)

$ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
$ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)

$ export AWS_SECRETSMANAGER_ACCESS_KEY=$(get-vault-secret.sh workfusion_WFInternal/AWS_SECRETSMANAGER_ACCESS_KEY)
$ export AWS_SECRETSMANAGER_SECRET_KEY=$(get-vault-secret.sh workfusion_WFInternal/AWS_SECRETSMANAGER_SECRET_KEY)

$ /opt/workfusion/kes/kes tool migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
# output should be similar to
# Migrated keys: 1 [ OK ]

Azure KeyVault

note

For the Multi-point installation, execute steps 2 and 3 on all Master servers.

To migrate the configuration to Azure KeyVault, do the following:

  1. Prepare the cloud infrastructure as described in the guide.

  2. In the config.yml file, specify the following parameters:

    $ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config master

# vault_kes_kms_provider=false
# azure_kes_kms_provider=true
# azure_key_vault_endpoint: 'set real value here'
# azure_key_vault_tenant_id: 'set real value here'
# azure_key_vault_client_id: 'set real value here'
# azure_key_vault_client_secret: 'set real value here'

  3. Apply the new configuration:

    $ ./install.sh configure kes

  4. Migrate the configuration to Azure KeyVault:

    $ export VAULT_TOKEN=$(get-vault-token.sh)

$ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
$ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)

$ export AZURE_KEY_VAULT_ENDPOINT=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_ENDPOINT)
$ export AZURE_KEY_VAULT_TENANT_ID=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_TENANT_ID)
$ export AZURE_KEY_VAULT_CLIENT_ID=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_CLIENT_ID)
$ export AZURE_KEY_VAULT_CLIENT_SECRET=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_CLIENT_SECRET)

$ /opt/workfusion/kes/kes tool migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
# output should be similar to
# Migrated keys: 1 [ OK ]
← Backup and restore custom Analytics dashboardsActivate Analytics license →