turn on default encryption for minio

[jessebot]

minio has oidc in front of the tenant, but encryption is not enabled by default yet. We should do that before next major release

[cloudymax]

We will need to write a function to enable SSE-C encryption on a per-bucket basis to run a few mc commands. Unfortunately we can't add any KMS other than vault or a major cloud 😕

https://min.io/docs/minio/linux/administration/server-side-encryption/server-side-encryption-sse-c.html

[jessebot]

oof, well, that shouldn't be the worst thing in the world. I wish OpenTofu would do something about Vault as well.

[cloudymax]

So for this issue, there's no way we can do what we want to do without using Vault or a non FOSS keyvault. Since weve gotten encryption up and running on Seaweedfs I think we can close this with the acknowledgement that if users want encryption by default, seaweedfs is the way to go.

[cloudymax]

Keeping open to re-evaluate of SSE-C in the vanilla helm chart

[cloudymax]

we dont use minio anymore