Migrate from Vault KMS to cloud-based KMS

The Work.AI platform uses internal Vault as KMS for MinIO encryption by default. The following guide describes how to switch KMS after the installation.

note

The guide assumes that:

• Your installer is in the /opt/workfusion/wf_installer directory.
• Work.AI is installed in the /opt/workfusion directory.
• All steps are executed once on the MASTER1 server.

Back up old KES configuration

To back up the old KES configuration, run the command:

$ cp /opt/workfusion/kes/server-config.yml /opt/workfusion/kes/server-config.yml.backup

Migrate to cloud-based KMS

AWS SecretsManager

To migrate the configuration to AWS SecretsManager, do the following:

1. Prepare the cloud infrastructure as described in the guide.

2. In the config.yml file, specify the following parameters:

   $ cd /opt/workfusion/wf_installer
   $ ./install.sh edit_config master
   
   # vault_kes_kms_provider=false
   # aws_kes_kms_provider=true
   # aws_secretsmanager_region: 'set real value here'
   # aws_secretsmanager_access_key: 'set real value here'
   # aws_secretsmanager_secret_key: 'set real value here'

3. Apply the new configuration:

   $ ./install.sh configure kes

4. Migrate the configuration to AWS SecretsManager:

   $ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
   $ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)
   
   $ export AWS_SECRETSMANAGER_ACCESS_KEY=$(get-vault-secret.sh workfusion_WFInternal/AWS_SECRETSMANAGER_ACCESS_KEY)
   $ export AWS_SECRETSMANAGER_SECRET_KEY=$(get-vault-secret.sh workfusion_WFInternal/AWS_SECRETSMANAGER_SECRET_KEY)
   
   $ /opt/workfusion/kes/kes tool migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
   # output should be similar to
   # Migrated keys: 1 [ OK ]

Azure KeyVault

To migrate the configuration to Azure KeyVault, do the following:

1. Prepare the cloud infrastructure as described in the guide.

2. In the config.yml file, specify the following parameters:

   $ cd /opt/workfusion/wf_installer
   $ ./install.sh edit_config master
   
   # vault_kes_kms_provider=false
   # azure_kes_kms_provider=true
   # azure_key_vault_endpoint: 'set real value here'
   # azure_key_vault_tenant_id: 'set real value here'
   # azure_key_vault_client_id: 'set real value here'
   # azure_key_vault_client_secret: 'set real value here'

3. Apply the new configuration:

   $ ./install.sh configure kes

4. Migrate the configuration to Azure KeyVault:

   $ export KES_VAULT_APPROLE_ROLE_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_ROLE_ID)
   $ export KES_VAULT_APPROLE_SECRET_ID=$(get-vault-secret.sh workfusion_WFInternal/KES_VAULT_APPROLE_SECRET_ID)
   
   $ export AZURE_KEY_VAULT_ENDPOINT=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_ENDPOINT)
   $ export AZURE_KEY_VAULT_TENANT_ID=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_TENANT_ID)
   $ export AZURE_KEY_VAULT_CLIENT_ID=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_CLIENT_ID)
   $ export AZURE_KEY_VAULT_CLIENT_SECRET=$(get-vault-secret.sh workfusion_WFInternal/AZURE_KEY_VAULT_CLIENT_SECRET)
   
   $ /opt/workfusion/kes/kes tool migrate --from /opt/workfusion/kes/server-config.yml.backup --to /opt/workfusion/kes/server-config.yml
   # output should be similar to
   # Migrated keys: 1 [ OK ]