3 posts tagged with "IBC NKV"

Overview​

The IonFS CLI provides a set of tools to manage secrets stored in IBC NKV as if it were a remote filesystem. While the secrets are stored within IBC NKV, the metadata is stored in a customer-controlled metadata repository.

Anyone that has been granted access to this repository, and the appropriate Ionburst Cloud Platform credentials, can interact with the stored secrets.

To get up and running quickly, we will be using the newly released IonFS CLI local metadata repository functionality.

Shared Responsibility Model Breakdown​

Customer Responsibility​

• You, the customer, are responsible for the secure management of the Ionburst Cloud credentials used by ionfs.
• You, the customer, are responsible for the security of ionfs metadata repositories and the metadata stored in them.

Ionburst Cloud Responsibility​

• We are responsible for the security of all secrets stored in IBC NKV using ionfs.
• We are responsible for the underlying security and availability of the Ionburst Cloud platform.

Getting Started​

In this tutorial we will cover:

1. Setting up ionfs.

2. Working with ionfs metadata repositories.

3. Listing IBC classifications with ionfs.

4. Working with ionfs directories.

5. Managing secrets with ionfs.

   Basic Usage​

ionfs allows us to do the following:

• List configured metadata repositories.
• List available IBC classifications.
• Create, list and delete ionfs directories.
• Upload, download and delete secrets from IBC NKV.

1. Setting up​

ionfs makes use of metadata repositories, or repos, to track the secrets that have been secured by IBC NKV. Metadata repos are specified in the configuration file stored under ~/.ionfs/appsettings.json.

For this tutorial, we are going to create a new local directory to use for ionfs metadata, along with the ~/.ionfs directory used to store our configuration file.

We can now set up our ionfs configuration file. First, add a new file to our newly created .ionfs directory.

For MacOS and Linux users:

For Windows users:

Open this file in your text editor of choice, and add the following:

Key points to note:

• setting the Usage entry to secrets is required to configure the repo for IBC NKV.
• the DataStore entry references the local directory we've created for metadata (remember to change the username), but it cannot use relative paths, i.e:
  • for MacOS: /Users/username/local-ionfs
  • for Linux: /home/username/local-ionfs
  • for Windows: /
• the Ionburst section relates to the Ionburst SDK credentials file. If you have an existing profile, you can add it here.

If you do not have an existing Ionburst credentials file, one can be created with the following:

For MacOS and Linux users:

For Windows users:

Open this file in your text editor of choice, and add the following (remember to add your Ionburst Cloud API credentials here):

2. Metadata Repos​

Now that we have ionfs setup, we can now start working with our metadata repo. To list the configured repos, the following ionfs command can be used:

An example output would look like:

3. Classifications​

Secrets can be secured by Ionburst Cloud according to available security policies. ionfs can be used to view the policies currently available to an Ionburst Cloud party.

To list available policies, the following can be used:

An example output would look like:

4. Directories​

Secrets secured by IBC S6 through ionfs can be organised within a repo using a typical directory structure.

List directories​

To list available directories within a repo, the following can be used:

As we marked the local-ionfs repo as the default, we can omit the name as it will be treated as the root.

An example output would look like:

By default, this will list the contents of the repo's root directory. To list a specific directory, the following can be used:

An example output would look like:

Create a directory​

To create a new directory within a repo, the following can be used:

An example output would look like:

Delete a directory​

To remove a directory within a repo, the following can be used:

An example output would look like:

5. Secrets​

Finally, and most importantly we can now look at uploading (Put), downloading (Get) and deleting secrets from IBC NKV using ionfs. In these examples, we'll use a secret called my-secret, with the value "We may guard your data, but we'll never take its freedom".

First, we need to create my-file.txt:

Put​

To upload a secret with ionfs, the following can be used:

An example output would look like:

To upload a secret to a specific directory within your repo, use the following:

An example output would look like:

Get​

To retrieve a secret with ionfs, use the following:

An example output would look like:

Delete​

To delete a secret from the ionfs repo and from Ionburst Cloud NKV, the following can be used:

An example output would look like:

Conclusion​

You should now be able to perform basic secrets operations on IBC NKV with ionfs. If you're interested in learning more about the IonFS CLI, please see the Ionburst Cloud docs.

Overview​

The Ionburst Cloud API HEAD method has been added to allow IBC S6 objects and IBC NKV secrets to be verified after upload, or queried to return information.

A HEAD request is functionally similar to a GET request; it is authenticated and requires the external reference of the object or secret to be checked. Instead of returning the specified object or secret, the HEAD request returns a status code and a response header with the size of the stored object or secret.

For full details of the HEAD method, please see the API docs for IBC S6, and IBC NKV.

Getting Started​

In this tutorial we will provide examples and code snippets of how to use the new HEAD method:

1. Using the HEAD method with ioncli
2. Using the HEAD method with the Ionburst Cloud Go SDK

ioncli​

In this example, we will upload a file, my-file.txt to IBC S6 using ioncli, then verify its size with the ioncli head command.

Creating my-file.txt:

Uploading my-file.txt with ioncli:

Checking my-file.txt with ioncli:

Example output:

Go SDK​

The following example program shows how the Ionburst Cloud Go SDK Head and HeadWithLen methods can be used:

Example output:

Overview​

The IonFS Command Line Interface provides a set of tools to manage data stored by Ionburst Cloud as if it were a remote filesystem. With the release of NKV, IonFS can now store secrets, while storing the metadata in a customer-owned metadata repository.

Anyone that has been granted access to this repository, and the appropriate Ionburst Cloud credentials, can interact with the stored secrets.

For this tutorial, we will be using Amazon S3 as the ionfs metadata repository.

Shared Responsibility Model Breakdown​

Customer Responsibility​

• You, the customer, are responsible for the secure management of the Ionburst Cloud credentials used by ionfs.
• You, the customer, are responsible for the security of ionfs metadata repositories and the metadata stored in them.

Ionburst Cloud Responsibility​

• We are responsible for the security of all secrets stored in Ionburst Cloud NKV using ionfs.
• We are responsible for the underlying security and availability of the Ionburst Cloud platform.

Getting Started​

In this tutorial we will cover:

1. Working with ionfs metadata repositories.
2. Listing IBC classifications with ionfs.
3. Working with ionfs directories.
4. Managing secrets with ionfs.

Basic Usage​

ionfs allows us to do the following:

• List configured metadata repositories.
• List available IBC classifications.
• Create, list and delete ionfs directories.
• Upload, download and delete secrets from IBC.

1. Metadata Repositories​

ionfs makes use of metadata repositories, or repos, to track secrets that have been secured by Ionburst Cloud NKV. Metadata repos are specified in the configuration file stored under ~/.ionfs/appsettings.json.

To list the configured repos, the following ionfs command can be used:

An example output would look like:

2. Classifications​

Secrets can be secured by Ionburst Cloud according to available security policies. ionfs can be used to view the policies currently available to an Ionburst Cloud party.

To list available policies, the following can be used:

An example output would look like:

3. Directories​

Secrets secured by Ionburst Cloud NKV through ionfs can partition its repo using a typical directory structure.

List directories​

To list available directories within a repo, the following can be used:

An example output would look like:

By default, this will list the contents of the repo's root directory. To list a specific directory, the following can be used:

An example output would look like:

Create a directory​

To create a new directory within a repo, the following can be used:

An example output would look like:

Delete a directory​

To remove a directory within a repo, the following can be used:

An example output would look like:

4. Secrets​

Finally, and most importantly we can now look at uploading (Put), downloading (Get) and deleting secrets from IBC NKV using ionfs. In these examples, we'll use a secret called my-secret, with the value "We may guard your data, but we'll never take its freedom".

Put​

To upload a secret with ionfs, the following can be used:

An example output would look like:

To upload a secret to a specific directory within your repo, use the following:

An example output would look like:

Get​

To retrieve a secret with ionfs, use the following:

An example output would look like:

Delete​

To delete a secret from the ionfs repo and from Ionburst Cloud NKV, the following can be used:

An example output would look like:

Conclusion​

You should now be able to perform basic secrets operations on Ionburst Cloud NKV using the ionfs tool. If you're interested in learning more about the IonFS CLI, please see the Ionburst Cloud docs.