Update documentation to add ingress and egress filters (#2771)

* Update documentation to add ingress and egress filters

website/content/docs/concepts/domain-model/credentials.mdx

@@ -39,6 +39,7 @@ format.
 - [Credential Store][]
 - [Credential Library][]
 - [Session][]
+- [Target][]
 
 [credential library]: /docs/concepts/domain-model/credential-libraries
 [credential libraries]: /docs/concepts/domain-model/credential-libraries
@@ -46,3 +47,4 @@ format.
 [credential stores]: /docs/concepts/domain-model/credential-stores
 [host]: /docs/concepts/domain-model/hosts
 [session]: /docs/concepts/domain-model/sessions
+[target]: /docs/concepts/domain-model/targets

website/content/docs/concepts/domain-model/targets.mdx

@@ -50,21 +50,61 @@ TCP targets have the following additional attributes:
   and the session is terminated
   when a session reaches the maximum duration.
   The default is 8 hours (28800 seconds).
-  Must be greater than 0.
+  This value must be greater than 0.
 
 - `session_connection_limit` - (required)
   The cumulative number of TCP connections allowed during a session.
-  -1 means no limit.
+  A -1 value means no limit.
   The default is -1.
   The value must be greater than 0 or exactly -1.
 
+- `egress_worker_filter` - (optional)
+  A boolean expression to [filter][] which egress workers can handle sessions
+  for this target.
+
+- `ingress_worker_filter` - (optional) <sup>HCP Only</sup>
+  A boolean expression to [filter][] which ingress workers can handle sessions
+  for this target.
+
+### SSH Target Attributes <sup>HCP Only</sup>
+
+SSH targets can source username/password or SSH private key credentials from Vault [credential libraries][] or static
+[credentials][]. Boundary then injects credentials into the SSH session between a client and end host. This allows users to
+securely connect to remote hosts using SSH, while never being in possession of a valid credential for that target host.
+
+SSH targets have the following additional attributes:
+
+- `session_max_seconds` - (required)
+  The maximum duration of an individual session between the user and the target.
+  All connections for a session are closed
+  and the session is terminated
+  when a session reaches the maximum duration.
+  The default is 8 hours (28800 seconds).
+  This value must be greater than 0.
+
+- `session_connection_limit` - (required)
+  The cumulative number of TCP connections allowed during a session.
+  A -1 value means no limit.
+  The default is -1.
+  The value must be greater than 0 or exactly -1.
+
+- `egress_worker_filter` - (optional)
+  A boolean expression to [filter][] which egress workers can handle sessions
+  for this target.
+
+- `ingress_worker_filter` - (optional) <sup>HCP Only</sup>
+  A boolean expression to [filter][] which ingress workers can handle sessions
+  for this target.
+
 ## Referenced By
 
 - [Credential Library][]
 - [Host Set][]
 - [Project][]
 - [Session][]
+- [Worker Filtering][]
 
+[credentials]: /docs/concepts/domain-model/credentials
 [credential library]: /docs/concepts/domain-model/credential-libraries
 [credential libraries]: /docs/concepts/domain-model/credential-libraries
 [credential store]: /docs/concepts/domain-model/credential-stores
@@ -83,6 +123,8 @@ TCP targets have the following additional attributes:
 [roles]: /docs/concepts/domain-model/roles
 [session]: /docs/concepts/domain-model/sessions
 [sessions]: /docs/concepts/domain-model/sessions
+[filter]: /docs/concepts/filtering/worker-tags
+[worker filtering]: /docs/concepts/filtering/worker-tags
 [user]: /docs/concepts/domain-model/users
 [users]: /docs/concepts/domain-model/users
 

website/content/docs/concepts/filtering/worker-tags.mdx

@@ -136,9 +136,15 @@ Following are some examples of using these values in filters:
 
 # Target Worker Filtering
 
-Once workers have tags, these tags may be used to control which
-workers are allowed to manage a given session by specifying a `worker_filter`
-attribute when configuring [targets](/docs/concepts/domain-model/targets).
+Once workers have tags, you can use these tags to control which
+workers are allowed to manage a given session by specifying optional worker filter attributes
+when you configure [targets](/docs/concepts/domain-model/targets).
+
+The `egress_worker_filter` attribute controls which workers are used for egress to a target. This is the worker
+that accesses the target.
+
+The `ingress_worker_filter`<sup>HCP Only</sup> attribute controls which workers are used for ingress to a target.
+This is the worker a client connects to when initiating a connection to a target.
 
 
 # Vault Worker Filtering <sup>HCP Only</sup>