luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Vault 3992 documentation changes (#14918) 

* doc changes

* adding config changes

* adding chnages to plugins

* using include

* making doc changes

* adding newline
This commit is contained in:
akshya96 2022-04-08 12:27:04 -07:00 committed by GitHub
parent 41a4b7a170
commit a0dbb30757
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
website/content/docs/configuration/index.mdx
View File

@ -8,6 +8,11 @@ description: Vault server configuration reference.
Outside of development mode, Vault servers are configured using a file.
The format of this file is [HCL](https://github.com/hashicorp/hcl) or JSON.
By default, Vault expects the config directory and files to be owned by the
user running Vault. It also expects no write or execute permissions for group or others.
This check can be disabled via the environment variable `VAULT_DISABLE_FILE_PERMISSIONS_CHECK`.
An example configuration is shown below:
```javascript
@ -117,6 +122,18 @@ to specify where the configuration is.
allowed to be loaded. Vault must have permission to read files in this
directory to successfully load plugins, and the value cannot be a symbolic link.
@include 'plugin-file-permissions-check.mdx'
- `plugin_file_uid` `(integer: 0)` – Uid of the plugin directories and plugin binaries.
By default, Vault expects the plugin directory and plugin binaries to be owned by
the user running Vault. This check can be disabled via the environment variable
`VAULT_DISABLE_FILE_PERMISSIONS_CHECK`.
- `plugin_file_permissions` `(string: "")` – Octal permission string of the plugin
directories and plugin binaries. By default, Vault expects no write or execute
permissions for group or others. This check can be disabled via the environment variable
`VAULT_DISABLE_FILE_PERMISSIONS_CHECK`.
- `telemetry` `([Telemetry][telemetry]: <none>)` – Specifies the telemetry
reporting system.

2
website/content/docs/plugins/index.mdx
View File

@ -12,6 +12,8 @@ allows both built-in and external plugins to be treated like Legos. Any plugin
can exist at multiple different locations. Different versions of a plugin may
be at each location, with each version differing from Vault's version.
@include 'plugin-file-permissions-check.mdx'
## Built-In Plugins
Built-in plugins are shipped with Vault, often for commonly used implementations,

8
website/content/docs/plugins/plugin-architecture.mdx
View File

@ -92,9 +92,11 @@ cannot be added to Vault unless it exists in the plugin directory. There is no
default for this configuration option, and if it is not set, plugins cannot be
added to Vault.
~> Warning: A Vault operator should take caution and lock down the permissions on
this directory to ensure a plugin cannot be modified by an unauthorized user
between the time of the SHA check and the time of plugin execution.
~> Warning: By default, Vault expects the plugin directory and files to be owned by the
user running Vault. It also expects no write or execute permissions for group or others.
Vault allows operators to specify the user and permissions of the plugin directory and binaries
using parameters `plugin_file_uid` and `plugin_file_permissions` in config if an operator needs those to be different.
This check can be disabled via the environment variable `VAULT_DISABLE_FILE_PERMISSIONS_CHECK`.
### Plugin Catalog

5
website/content/partials/plugin-file-permissions-check.mdx Normal file
View File

@ -0,0 +1,5 @@
By default, Vault expects the plugin directory and files to be owned by the
user running Vault. It also expects no write or execute permissions for group or others.
Vault allows operators to specify the user and permissions of the plugin directory and binaries
using parameters `plugin_file_uid` and `plugin_file_permissions` if an operator needs those to be different.
This check can be disabled via the environment variable `VAULT_DISABLE_FILE_PERMISSIONS_CHECK`.