apiVersion: v1
kind: Secret
metadata:
  name: kes-configuration
type: Opaque
stringData:
  server-config.yaml: |-
    address: :7373
    root: _ # Effectively disabled since no root identity necessary.
    tls:
      key: /tmp/kes/server.key   # Path to the TLS private key
      cert: /tmp/kes/server.crt # Path to the TLS certificate
      proxy:
        identities: []
        header:
          cert: X-Tls-Client-Cert
    policy:
      my-policy:
        paths:
        - /v1/key/create/*
        - /v1/key/generate/*
        - /v1/key/decrypt/*
        identities:
        - ${MINIO_KES_IDENTITY}
    cache:
      expiry:
        any: 5m0s
        unused: 20s
    log:
      error: on
      audit: off
    keys:
      ## KES configured with fs (File System mode) doesnt work in Kubernetes environments and it's not recommended
      ## use a real KMS
      # fs:
      #   path: "./keys" # Path to directory. Keys will be stored as files. Not Recommended for Production.
      vault:
        endpoint: "http://vault.default.svc.cluster.local:8200" # The Vault endpoint
        namespace: "" # An optional Vault namespace. See: https://www.vaultproject.io/docs/enterprise/namespaces/index.html
        prefix: "my-minio"    # An optional K/V prefix. The server will store keys under this prefix.
        approle:    # AppRole credentials. See: https://www.vaultproject.io/docs/auth/approle.html
          id: "<YOUR APPROLE ID HERE>"      # Your AppRole Role ID
          secret: "<YOUR APPROLE SECRET ID HERE>"  # Your AppRole Secret ID
          retry: 15s  # Duration until the server tries to re-authenticate after connection loss.
        tls:        # The Vault client TLS configuration for mTLS authentication and certificate verification
          key: ""     # Path to the TLS client private key for mTLS authentication to Vault
          cert: ""    # Path to the TLS client certificate for mTLS authentication to Vault
          ca: ""      # Path to one or multiple PEM root CA certificates
        status:     # Vault status configuration. The server will periodically reach out to Vault to check its status.
          ping: 10s   # Duration until the server checks Vault's status again.
      # aws:
      #   # The AWS SecretsManager key store. The server will store
      #   # secret keys at the AWS SecretsManager encrypted with
      #   # AWS-KMS. See: https://aws.amazon.com/secrets-manager
      #   secretsmanager:
      #     endpoint: ""   # The AWS SecretsManager endpoint      - e.g.: secretsmanager.us-east-2.amazonaws.com
      #     region: ""     # The AWS region of the SecretsManager - e.g.: us-east-2
      #     kmskey: ""     # The AWS-KMS key ID used to en/decrypt secrets at the SecretsManager. By default (if not set) the default AWS-KMS key will be used.
      #     credentials:   # The AWS credentials for accessing secrets at the AWS SecretsManager.
      #       accesskey: ""  # Your AWS Access Key
      #       secretkey: ""  # Your AWS Secret Key
      #       token: ""      # Your AWS session token (usually optional)
