Kaspersky Container Security

Configuring the MinIO external storage settings

To configure the Kaspersky Container Security settings to use the external S3-compatible MinIO file storage:

1. In the values.yaml configuration file, specify that the solution uses external MinIO file storage:

   default:

   kcs-s3:

   external: true

2. Specify variable values for using MinIO:

   configmap:

   infraconfig:

   type: fromEnvs

   envs:

   ... variables for using the external MinIO file storage >

   In this section you must specify the following variables:

   • MINIO_HOST is the host to connect to MinIO.
   • MINIO_PORT is the port to connect to MinIO.
   • MINIO_BUCKET_NAME is the name of the section in MinIO allocated for Kaspersky Container Security data.
   • MINIO_SSL is the variable for ssl connection to MinIO (including using the https protocol).

     If TLS_INTERNAL is false, MINIO_SSL must also be false.

   • MINIO_ROOT_CA_PATH is the path to the CA certificate, which is specified if the https protocol is used to connect to MinIO (MINIO_SSL: true). You can specify the path in one of the following ways:
     • Put the MinIO CA certificate in the directory specified by the path. In this case, you must uncomment the secret.cert-minio-ca block.
     • Use Vault to store certificate data. In this case, you must uncomment the cert-minio-ca block in the vault.certificate section.
3. Specify values of secrets for using the external MinIO file storage:

   configmap:

   secret:

   infracreds:

   type: fromEnvs

   envs:

   ...<secrets for using the external MinIO file storage>

   In this section you must specify the following:

   • MINIO_ROOT_USER is the name of the MinIO user specified for Kaspersky Container Security.
   • MINIO_ROOT_PASSWORD is the password of the MinIO user user specified for Kaspersky Container Security.

   Usernames and passwords can also be specified using the Vault secret storage.

   Example of configuring the MinIO external file storage settings

   kcs-s3:

   enabled: true

   external: true

   ...

   configmap:

   infraconfig:

   type: fromEnvs

   envs:

   ...

   MINIO_HOST: kcs-s3

   MINIO_PORT: 9000

   MINIO_BUCKET_NAME: reports

   MINIO_SSL: true

   MINIO_ROOT_CA_PATH: /etc/ssl/certs/minio-ca.crt

   ...

   secret:

   ...

   infracreds:

   type: fromEnvs

   envs:

   ...

   MINIO_ROOT_USER: kcs_user

   MINIO_ROOT_PASSWORD: ********

   ...

   When using Vault:

   vault:

   ...

   secret:

   type: managedByVault

   ...

   MINIO_ROOT_USER: kv/test/minio@MINIO_ROOT_USER

   MINIO_ROOT_PASSWORD: kv/test/minio@MINIO_ROOT_PASSWORD