Skip to content

Commit af3d8ab

Browse files
djwfyidjwfyi
authored
Updates for two October 2024 releases (#1353)
Deprecates a no longer used operator environment variable. Closes #1351 Adds `mc admin accesskey` and subcommands. Updates `mc admin user svcacct` and subcommands with reference to new commands. Closes #1350
1 parent b79934f commit af3d8ab

19 files changed

+1135
-7
lines changed

‎source/reference/minio-mc-admin.rst‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ The following table lists :mc:`mc admin` commands:
3535
* - Command
3636
- Description
3737

38+
* - :mc:`mc admin accesskey`
39+
- .. include:: /reference/minio-mc-admin/mc-admin-accesskey.rst
40+
:start-after: start-mc-admin-accesskey-desc
41+
:end-before: end-mc-admin-accesskey-desc
42+
3843
* - :mc:`mc admin cluster bucket`
3944
- .. include:: /reference/minio-mc-admin/mc-admin-cluster-bucket.rst
4045
:start-after: start-mc-admin-cluster-bucket-desc
@@ -174,6 +179,7 @@ See :ref:`minio-mc-global-options`.
174179
:hidden:
175180
:glob:
176181

182+
/reference/minio-mc-admin/mc-admin-accesskey
177183
/reference/minio-mc-admin/mc-admin-cluster-bucket
178184
/reference/minio-mc-admin/mc-admin-cluster-iam
179185
/reference/minio-mc-admin/mc-admin-config

‎source/reference/minio-mc-admin/mc-admin-accesskey-create.rst‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
.. _minio-mc-admin-accesskey-create:
2+
3+
=============================
4+
``mc admin accesskey create``
5+
=============================
6+
7+
.. default-domain:: minio
8+
9+
.. contents:: Table of Contents
10+
:local:
11+
:depth: 2
12+
13+
.. mc:: mc admin accesskey create
14+
15+
16+
Syntax
17+
------
18+
19+
.. start-mc-admin-accesskey-create-desc
20+
21+
The :mc-cmd:`mc admin accesskey create` command adds a new access key and secret key pair for an existing MinIO user.
22+
23+
.. end-mc-admin-accesskey-create-desc
24+
25+
.. admonition:: Access keys for OpenID Connect or AD/LDAP users
26+
:class: note
27+
28+
This command is for access keys for users created directly on the MinIO deployment and not managed by a third party solution.
29+
30+
- To generate access keys for :ref:`OpenID Connect users <minio-external-identity-management-openid>`, use the :ref:`MinIO Console <minio-console>`.
31+
32+
- To generate access keys for :ref:`Active Directory/LDAP users <minio-external-identity-management-ad-ldap>`, use :mc:`mc idp ldap accesskey create`.
33+
34+
.. tab-set::
35+
36+
.. tab-item:: EXAMPLE
37+
38+
The following command creates a new access key associated to an existing MinIO user:
39+
40+
.. code-block:: shell
41+
:class: copyable
42+
43+
mc admin accesskey create \
44+
myminio/ myuser \
45+
--access-key myuseraccesskey \
46+
--secret-key myusersecretkey \
47+
--policy /path/to/policy.json
48+
49+
The command returns the access key and secret key for the new account.
50+
51+
.. tab-item:: SYNTAX
52+
53+
The command has the following syntax:
54+
55+
.. code-block:: shell
56+
:class: copyable
57+
58+
mc [GLOBALFLAGS] admin accesskey create \
59+
ALIAS \
60+
[USER] \
61+
[--access-key string] \
62+
[--secret-key string] \
63+
[--policy path] \
64+
[--name string] \
65+
[--description string] \
66+
[--expiry-duration value] \
67+
[--expiry date]
68+
69+
.. include:: /includes/common-minio-mc.rst
70+
:start-after: start-minio-syntax
71+
:end-before: end-minio-syntax
72+
73+
74+
Parameters
75+
~~~~~~~~~~
76+
77+
.. mc-cmd:: ALIAS
78+
:required:
79+
80+
The :mc-cmd:`alias <mc alias>` of the MinIO deployment.
81+
82+
.. mc-cmd:: USER
83+
:optional:
84+
85+
The username of the user to which MinIO adds the new access key.
86+
If not specified, MinIO generates an access key/secret key pair for the authenticated user.
87+
88+
.. mc-cmd:: --access-key
89+
:optional:
90+
91+
A string to use as the access key for this account.
92+
Omit to let MinIO autogenerate a random 20 character value.
93+
94+
Access Key names *must* be unique across all users.
95+
96+
.. mc-cmd:: --description
97+
:optional:
98+
99+
Add a description for the access key.
100+
For example, you might specify the reason the access key exists.
101+
102+
.. mc-cmd:: --expiry
103+
:optional:
104+
105+
Set an expiration date for the access key.
106+
The date must be in the future.
107+
You may not set an expiration date that has already passed.
108+
109+
Allowed date and time formats:
110+
111+
- ``2024-10-24``
112+
- ``2024-10-24T10:00``
113+
- ``2024-10-24T10:00:00``
114+
- ``2024-10-24T10:00:00Z``
115+
- ``2024-10-24T10:00:00-07:00``
116+
117+
Mutually exclusive with :mc-cmd:`~mc admin accesskey create --expiry-duration`.
118+
119+
.. mc-cmd:: --expiry-duration
120+
:optional:
121+
122+
Length of time for which the accesskey remains valid.
123+
124+
For example, ``30m, ``24h``, ``30d``, or similar.
125+
The following expires the credentials after 30 days:
126+
127+
.. code-block::
128+
129+
--expiry-duration 30d
130+
131+
Mutually exclusive with :mc-cmd:`~mc admin accesskey create --expiry`.
132+
133+
.. mc-cmd:: --name
134+
:optional:
135+
136+
Add a human-readable name for the access key.
137+
138+
.. mc-cmd:: --policy
139+
:optional:
140+
141+
The readable path to a :ref:`policy document <minio-policy>` to attach to the new access key, with a maximum size of 2048 characters.
142+
The attached policy cannot grant access to any action or resource not explicitly allowed by the parent user's policy or group policies
143+
144+
.. mc-cmd:: --secret-key
145+
:optional:
146+
147+
The secret key to associate with the new account.
148+
Omit to let MinIO autogenerate a random 40-character value.
149+
150+
151+
Global Flags
152+
~~~~~~~~~~~~
153+
154+
.. include:: /includes/common-minio-mc.rst
155+
:start-after: start-minio-mc-globals
156+
:end-before: end-minio-mc-globals
157+
158+
159+
Examples
160+
--------
161+
162+
Create access key / secret key pair for the authenticated user
163+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
164+
165+
The following command generates a new, random access key and secret key pair for the user currently logged in to MinIO deployment at the alias ``myminio``.
166+
The access key and secret key have the same access policies as the authenticated user.
167+
168+
.. code-block:: shell
169+
:class: copyable
170+
171+
mc admin accesskey create myminio/
172+
173+
Create a custom access key / secret key pair for the authenticated user
174+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
175+
176+
The following command creates a new access key and secret key pair for the user currently logged in to MinIO at the alias ``myminio``.
177+
The access key and secret key have the same access policies as the authenticated user.
178+
179+
.. code-block:: shell
180+
:class: copyable
181+
182+
mc admin accesskey create myminio/ --access-key myaccesskey --secret-key mysecretkey
183+
184+
Create an access key / secret key pair for another user with limited duration
185+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
186+
187+
The following command creates a new access key and secret key pair for a user, ``miniouser`` on the alias ``myminio``.
188+
The access key and secret key have the same access policies as ``miniouser``.
189+
The credentials remain valid for 24 hours after creation.
190+
191+
.. code-block:: shell
192+
:class: copyable
193+
194+
mc admin accesskey create myminio/ miniouser --expiry-duration 24h
195+
196+
197+
Create access key / secret key pair for the authenticated user that expires
198+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
199+
200+
The following command generates a new and random access key and random secret key pair for the user currently logged in to MinIO deployment at the alias ``myminio``.
201+
The access key and secret key have the same access policies as the authenticated user.
202+
The credentials expire on the fifteenth day of January, 2025.
203+
204+
.. code-block:: shell
205+
:class: copyable
206+
207+
mc admin accesskey create myminio/ --expiry 2025-01-15
208+
209+
The date specified **must** be a future date.
210+
For valid datetime formats, see the :mc-cmd:`~mc admin accesskey create --expiry` flag.
211+
212+
Create access key / secret key pair for a different user with custom access
213+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
214+
215+
The following command creates a new access key and secret key pair for the user, ``miniouser`` on the alias ``myminio``.
216+
The access key and secret key have a more limited set of access than ``miniouser``, as specified in the policy JSON file.
217+
218+
.. code-block:: shell
219+
:class: copyable
220+
221+
mc admin accesskey create myminio/ miniouser --policy /path/to/policy.json
222+
223+
The specified policy file **must not** grant access to anything to which ``miniouser`` does not already have access.
224+
225+
Behavior
226+
--------
227+
228+
S3 Compatibility
229+
~~~~~~~~~~~~~~~~
230+
231+
.. include:: /includes/common-minio-mc.rst
232+
:start-after: start-minio-mc-s3-compatibility
233+
:end-before: end-minio-mc-s3-compatibility

‎source/reference/minio-mc-admin/mc-admin-accesskey-disable.rst‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
.. _minio-mc-admin-accesskey-disable:
2+
3+
==============================
4+
``mc admin accesskey disable``
5+
==============================
6+
7+
.. default-domain:: minio
8+
9+
.. contents:: Table of Contents
10+
:local:
11+
:depth: 2
12+
13+
.. mc:: mc admin accesskey disable
14+
15+
16+
Syntax
17+
------
18+
19+
.. start-mc-admin-accesskey-disable-desc
20+
21+
The :mc-cmd:`mc admin accesskey disable` command disables an existing access key for a MinIO IDP user.
22+
23+
.. end-mc-admin-accesskey-disable-desc
24+
25+
.. tab-set::
26+
27+
.. tab-item:: EXAMPLE
28+
29+
The following command disables the specified access key:
30+
31+
.. code-block:: shell
32+
:class: copyable
33+
34+
mc admin accesskey disable myminio myuserserviceaccount
35+
36+
.. tab-item:: SYNTAX
37+
38+
The command has the following syntax:
39+
40+
.. code-block:: shell
41+
:class: copyable
42+
43+
mc [GLOBALFLAGS] admin accesskey disable \
44+
ALIAS \
45+
SERVICEACCOUNT
46+
47+
.. include:: /includes/common-minio-mc.rst
48+
:start-after: start-minio-syntax
49+
:end-before: end-minio-syntax
50+
51+
52+
Parameters
53+
~~~~~~~~~~
54+
55+
.. mc-cmd:: ALIAS
56+
:required:
57+
58+
The :mc-cmd:`alias <mc alias>` of the MinIO deployment.
59+
60+
.. mc-cmd:: SERVICEACCOUNT
61+
:required:
62+
63+
The access key to disable.
64+
65+
66+
Global Flags
67+
~~~~~~~~~~~~
68+
69+
.. include:: /includes/common-minio-mc.rst
70+
:start-after: start-minio-mc-globals
71+
:end-before: end-minio-mc-globals
72+
73+
74+
Behavior
75+
--------
76+
77+
S3 Compatibility
78+
~~~~~~~~~~~~~~~~
79+
80+
.. include:: /includes/common-minio-mc.rst
81+
:start-after: start-minio-mc-s3-compatibility
82+
:end-before: end-minio-mc-s3-compatibility

0 commit comments

Comments
 (0)