# KMS IAM/Config Encryption

MinIO supports encrypting config, IAM assets with KMS provided keys. If the KMS is not enabled, MinIO will store the config, IAM data as plain text erasure coded in its backend.

## MinIO KMS Quick Start

MinIO supports two ways of encrypting IAM and configuration data.
You can either use KES - together with an external KMS - or, much simpler,

# reexport_tf_summary can get compat from sys.modules. Only needed if using
# lazy loading.
_current_module.compat.v2  # pylint: disable=pointless-statement

# Load tensorflow-io-gcs-filesystem if enabled
if (_os.getenv("TF_USE_MODULAR_FILESYSTEM", "0") == "true" or
    _os.getenv("TF_USE_MODULAR_FILESYSTEM", "0") == "1"):
  import tensorflow_io_gcs_filesystem as _tensorflow_io_gcs_filesystem

# Lazy-load Keras v1.

                                            <la:option value="true">
                                                <la:message key="labels.enabled"/>
                                            </la:option>
                                            <la:option value="false">
                                                <la:message key="labels.disabled"/>

	if objAPI == nil {
		return errServerNotInitialized
	}
	info, err := globalSiteReplicationSys.GetClusterInfo(ctx)
	if err != nil {
		return err
	}
	if !info.Enabled {
		return nil
	}
	for _, peer := range info.Sites {
		if peer.DeploymentID == globalDeploymentID() {
			continue
		}
		rs, err := loadSiteResyncMetadata(ctx, objAPI, peer.DeploymentID)
		if err != nil {

- No "admin:*" operations are needed for FTP/SFTP access to the bucket(s) and object(s), so you may
  skip them for restrictions.

## Usage

Start MinIO in a distributed setup, with 'ftp/sftp' enabled.

```
minio server http://server{1...4}/disk{1...4}
   --ftp="address=:8021" --ftp="passive-port-range=30000-40000" \
   --sftp="address=:8022" --sftp="ssh-private-key=/home/miniouser/.ssh/id_rsa"
...
...
```

  // PersistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from
  // the StatefulSet VolumeClaimTemplates. This requires the
  // StatefulSetAutoDeletePVC feature gate to be enabled, which is alpha.
  // +optional
  optional StatefulSetPersistentVolumeClaimRetentionPolicy persistentVolumeClaimRetentionPolicy = 10;

  // ordinals controls the numbering of replica indices in a StatefulSet. The

- Send GCE node startup scripts' logs to console and journal. ([#95311](https://github.com/kubernetes/kubernetes/pull/95311), [@karan](https://github.com/karan))

  // volume claims when their stateful set is deleted, or when their pod is scaled
  // down. This requires the StatefulSetAutoDeletePVC feature gate to be enabled,
  // which is alpha.  +optional
  optional StatefulSetPersistentVolumeClaimRetentionPolicy persistentVolumeClaimRetentionPolicy = 10;

  // ordinals controls the numbering of replica indices in a StatefulSet. The

    *   The VolumeScheduling feature gate must also be enabled on kube-scheduler and kube-controller-manager components.
    *   The NoVolumeNodeConflict predicate has been removed.  For non-default schedulers, update your scheduler policy.

* Introduce support for applying pod overhead to pod cgroups, if the PodOverhead feature is enabled. ([#79247](https://github.com/kubernetes/kubernetes/pull/79247), [@egernst](https://github.com/egernst))
* Windows nodes on GCE now run with Windows Defender enabled. ([#81625](https://github.com/kubernetes/kubernetes/pull/81625), [@pjh](https://github.com/pjh))



# v1.16.0-beta.1