From 30ede3b13798ee83ad9cbfb07847d896462e0398 Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Tue, 9 Aug 2022 17:56:29 -0400 Subject: [PATCH] Fix various website issues (#2344) I found some invalid links and some missing KMS information; this fixes those. --- .../concepts/security/data-encryption.mdx | 19 ++++++++++++++----- .../events/{overview.mdx => index.mdx} | 0 website/content/docs/configuration/index.mdx | 4 ++-- .../worker/{overview.mdx => index.mdx} | 2 +- website/data/docs-nav-data.json | 4 ++-- 5 files changed, 19 insertions(+), 10 deletions(-) rename website/content/docs/configuration/events/{overview.mdx => index.mdx} (100%) rename website/content/docs/configuration/worker/{overview.mdx => index.mdx} (98%) diff --git a/website/content/docs/concepts/security/data-encryption.mdx b/website/content/docs/concepts/security/data-encryption.mdx index 92220ad20..9c9e356d4 100644 --- a/website/content/docs/concepts/security/data-encryption.mdx +++ b/website/content/docs/concepts/security/data-encryption.mdx @@ -18,7 +18,14 @@ will be supported in a future version. External keys can be rotated so long as the original keys remain available for decryption; full support for rotating these will come in a future version as well. -## The `root` KMS Key and Per-Scope KEK/DEKs +## The `worker-auth-storage` KMS Key + +The `worker-auth-storage` KMS key is used by a [PKI +Worker](/docs/configuration/worker/pki-worker) for storage of authentication +keys. It is optional for PKI workers; if not specified the authentication keys +will not be encrypted on disk. This is not used by KMS workers. + +## The `root` KMS Key and Per-Scope KEK/DEKs OSS Only Following best practices of using different encryption keys for different purposes, Boundary has a number of encryption keys generated within each scope. @@ -48,13 +55,15 @@ provided in this section is purely for informational purposes. - `sessions`: This is used as a base key against which to derive session-specific encryption keys. -## The `worker-auth` KMS Key +## The `worker-auth` KMS Key OSS Only The `worker-auth` KMS key is a key shared by the Controller and Worker in order to authenticate a Worker to the Controller. Specifics of this mechanism can be -found on the [Connections/TLS page](/docs/concepts/security/connections-tls). +found on the [Connections/TLS page](/docs/concepts/security/connections-tls). If +a worker is used with [PKI +authentication](/docs/configuration/worker/pki-worker) this is unnecessary. -## The `recovery` KMS Key +## The `recovery` KMS Key OSS Only The `recovery` KMS key is used for rescue/recovery operations that can be used by a client to authenticate almost any operation within Boundary. Its mechanism @@ -90,7 +99,7 @@ with the options to skip creating default resources, Terraform can be used to create the specific resources needed instead, with the `recovery` KMS used to authenticate setting up the initial auth method(s). -## The `config` KMS Key +## The `config` KMS Key OSS Only This key can be used to encrypt values within Boundary's configuration file. By sharing this block between Boundary and an operator, the operator can put diff --git a/website/content/docs/configuration/events/overview.mdx b/website/content/docs/configuration/events/index.mdx similarity index 100% rename from website/content/docs/configuration/events/overview.mdx rename to website/content/docs/configuration/events/index.mdx diff --git a/website/content/docs/configuration/index.mdx b/website/content/docs/configuration/index.mdx index f028f4d76..72e229b1c 100644 --- a/website/content/docs/configuration/index.mdx +++ b/website/content/docs/configuration/index.mdx @@ -46,7 +46,7 @@ path to the file. - [`kms`](/docs/configuration/kms): Configures KMS blocks [for various purposes](/docs/concepts/security/data-encryption). -- [`events`](/docs/configuration/events/overview): Configures event (observability, +- [`events`](/docs/configuration/events): Configures event (observability, audit, error) handling. - `disable_mlock` `(bool: false)` – Disables the server from executing the @@ -82,7 +82,7 @@ path to the file. ## OSS-Only Parameters -- [`controller`](/docs/configuration/controller)<: Controller specific +- [`controller`](/docs/configuration/controller): Controller specific configuration. If present, `boundary server` will start a Controller subprocess. - [`plugins`](/docs/configuration/plugins): Configures options for plugins. diff --git a/website/content/docs/configuration/worker/overview.mdx b/website/content/docs/configuration/worker/index.mdx similarity index 98% rename from website/content/docs/configuration/worker/overview.mdx rename to website/content/docs/configuration/worker/index.mdx index 3de6b062a..90befbf1e 100644 --- a/website/content/docs/configuration/worker/overview.mdx +++ b/website/content/docs/configuration/worker/index.mdx @@ -1,6 +1,6 @@ --- layout: docs -page_title: Worker - Overview +page_title: Worker - Configuration description: |- The worker stanza configures worker-specific parameters. --- diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json index e6fbc4b5c..d95182bb9 100644 --- a/website/data/docs-nav-data.json +++ b/website/data/docs-nav-data.json @@ -50,7 +50,7 @@ "routes": [ { "title": "Overview", - "path": "configuration/worker/overview" + "path": "configuration/worker" }, { "title": "PKI Workers", @@ -121,7 +121,7 @@ "routes": [ { "title": "Overview", - "path": "configuration/events/overview" + "path": "configuration/events" }, { "title": "Common Sink Parameters",