next

Edit

Migrate from Vault KMS to cloud-based KMS

IA Cloud Enterprise uses internal Vault as KMS for Minio encryption by default. For more information, see Configure KMS server for MinIO encryption.

The following guide describes how to switch KMS after the installation.

note

The guide assumes that:

  • Your installer is in the /opt/workfusion/wf_installer directory.
  • IA Cloud is installed in the /opt/workfusion directory.
  • All steps are executed once on the MASTER1 server.

Backup old KES configuration

To back up the old KES configuration, run the command:

$ cp /opt/workfusion/kes/server-config.yml /opt/workfusion/kes/server-config.yml.backup

Migrate to cloud-based KMS

AWS SecretsManager

note

For the Multi-point installation, execute steps 2 and 3 on all Master servers.

To migrate the configuration to AWS SecretsManager, do the following:

  1. Prepare the cloud infrastructure as described in the guide.

  2. In the config.yml file, specify the following parameters:

    $ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config master

# vault_kes_kms_provider=false
# aws_kes_kms_provider=true
# aws_secretsmanager_region: 'set real value here'
# aws_secretsmanager_access_key: 'set real value here'
# aws_secretsmanager_secret_key: 'set real value here'

  3. Apply the new configuration:

    $ ./install.sh configure kes

  4. Migrate the configuration to AWS SecretsManager:

    $ export VAULT_TOKEN=$(get-vault-token.sh)

$ export MINIO_IDENTITY=$(/opt/workfusion/kes/kes identity of /opt/workfusion/ssl/server.crt)
$ export ADMIN_IDENTITY=$(/opt/workfusion/kes/kes identity of /opt/workfusion/ssl/mtls-auth.crt)

$ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
$ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)

$ export AWS_SECRETSMANAGER_ACCESS_KEY=$(get-vault-secret.sh workfusion_WFInternal/AWS_SECRETSMANAGER_ACCESS_KEY)
$ export AWS_SECRETSMANAGER_SECRET_KEY=$(get-vault-secret.sh workfusion_WFInternal/AWS_SECRETSMANAGER_SECRET_KEY)

$ /opt/workfusion/kes/kes migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
# output should be similar to
# Migrated keys: 1 [ OK ]

Azure KeyVault

note

For the Multi-point installation, execute steps 2 and 3 on all Master servers.

To migrate the configuration to Azure KeyVault, do the following:

  1. Prepare the cloud infrastructure as described in the guide.

  2. In the config.yml file, specify the following parameters:

    $ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config master

# vault_kes_kms_provider=false
# azure_kes_kms_provider=true
# azure_key_vault_endpoint: 'set real value here'
# azure_key_vault_tenant_id: 'set real value here'
# azure_key_vault_client_id: 'set real value here'
# azure_key_vault_client_secret: 'set real value here'

  3. Apply the new configuration:

    $ ./install.sh configure kes

  4. Migrate the configuration to Azure KeyVault:

    $ export VAULT_TOKEN=$(get-vault-token.sh)

$ export MINIO_IDENTITY=$(/opt/workfusion/kes/kes identity of /opt/workfusion/ssl/server.crt)
$ export ADMIN_IDENTITY=$(/opt/workfusion/kes/kes identity of /opt/workfusion/ssl/mtls-auth.crt)

$ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
$ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)

$ export AZURE_KEY_VAULT_ENDPOINT=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_ENDPOINT)
$ export AZURE_KEY_VAULT_TENANT_ID=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_TENANT_ID)
$ export AZURE_KEY_VAULT_CLIENT_ID=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_CLIENT_ID)
$ export AZURE_KEY_VAULT_CLIENT_SECRET=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_CLIENT_SECRET)

$ /opt/workfusion/kes/kes migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
# output should be similar to
# Migrated keys: 1 [ OK ]

GCP SecretManager

note

For the Multi-point installation, execute steps 2 and 3 on all Master servers.

To migrate the configuration to GCP SecretManager, do the following:

  1. Prepare the cloud infrastructure as described in the guide.

  2. In the config.yml file, specify the following parameters:

    $ cd /opt/workfusion/wf_installer
$ ./install.sh edit_config master

# vault_kes_kms_provider=false
# gcp_kes_kms_provider=true
# gcp_secretmanager_project_id: 'set real value here'
# gcp_secretmanager_client_email: 'set real value here'
# gcp_secretmanager_client_id: 'set real value here'
# gcp_secretmanager_private_key_id: 'set real value here'
# gcp_secretmanager_private_key: 'set real value here'

  3. Apply the new configuration:

    $ ./install.sh configure kes

  4. Migrate the configuration to Azure KeyVault:

    $ export VAULT_TOKEN=$(get-vault-token.sh)

$ export MINIO_IDENTITY=$(/opt/workfusion/kes/kes identity of /opt/workfusion/ssl/server.crt)
$ export ADMIN_IDENTITY=$(/opt/workfusion/kes/kes identity of /opt/workfusion/ssl/mtls-auth.crt)

$ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
$ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)

$ export GCP_SECRETMANAGER_PROJECT_ID=$(get-vault-secret.sh workfusion_WFInternal/GCP_SECRETMANAGER_PROJECT_ID)
$ export GCP_SECRETMANAGER_CLIENT_EMAIL=$(get-vault-secret.sh workfusion_WFInternal/GCP_SECRETMANAGER_CLIENT_EMAIL)
$ export GCP_SECRETMANAGER_CLIENT_ID=$(get-vault-secret.sh workfusion_WFInternal/GCP_SECRETMANAGER_CLIENT_ID)
$ export GCP_SECRETMANAGER_PRIVATE_KEY_ID=$(get-vault-secret.sh workfusion_WFInternal/GCP_SECRETMANAGER_PRIVATE_KEY_ID)
$ export GCP_SECRETMANAGER_PRIVATE_KEY=$(get-vault-secret.sh workfusion_WFInternal/GCP_SECRETMANAGER_PRIVATE_KEY)

$ /opt/workfusion/kes/kes migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
# output should be similar to
# Migrated keys: 1 [ OK ]
← Backup and restore custom Analytics dashboardsActivate Analytics license →