diff --git a/website/source/docs/concepts/tokens.html.md b/website/source/docs/concepts/tokens.html.md index 09f72c41b..90c3f81c5 100644 --- a/website/source/docs/concepts/tokens.html.md +++ b/website/source/docs/concepts/tokens.html.md @@ -3,7 +3,7 @@ layout: "docs" page_title: "Tokens" sidebar_current: "docs-concepts-tokens" description: |- - Tokens are a core authentication method in Vault. Concepts and important features. + Tokens are a core authentication method in Vault. Concepts and important features. --- # Tokens @@ -54,7 +54,7 @@ of version 0.6.1, there are only three ways to create root tokens: expiration 2. By using another root token; a root token with an expiration cannot create a root token that never expires -3. By using `vault generate-root` ([example](../cookbook/index.html#generate-a-root-token-when-none-exists)) +3. By using `vault generate-root` ([example](../guides/generate-root.html)) with the permission of a quorum of unseal key holders Root tokens are useful in development but should be extremely carefully guarded @@ -205,5 +205,5 @@ to be given periodic tokens. There are a few important things to know when using periodic tokens: -* When a periodic token is created via a token store role, the _current_ value of the role's period setting will be used at renewal time +* When a periodic token is created via a token store role, the _current_ value of the role's period setting will be used at renewal time * A token with both a period and an explicit max TTL will act like a periodic token but will be revoked when the explicit max TTL is reached diff --git a/website/source/docs/cookbook/index.html.md b/website/source/docs/cookbook/index.html.md deleted file mode 100644 index 89a37fd96..000000000 --- a/website/source/docs/cookbook/index.html.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -layout: "docs" -page_title: "Vault Cookbook" -sidebar_current: "docs-cookbook" -description: |- - Vault server how-to cookbook. ---- - -# Day-to-day tasks with Vault - -## Generate a root token (when none exists) - -It's considered [best practice](../concepts/tokens.html#root-tokens) not to keep root tokens around, as they are all-powerful. Instead, if one is absolutely needed, create it using vault's generate-root command: - -1. Unseal the vault. You do not need to be authenticated (you do not need an existing root token). -2. Generate a one-time password with `vault generate-root -genotp` -3. Get the encoded root token: `vault generate-root -otp ` (Requires a quorum of unseal keys again, so needs to be done \ times.) -4. Decode the encoded root token with `vault generate-root -otp -decode= ` - -(See `vault generate-root -h` for information on the alternate technique using a PGP key.) diff --git a/website/source/docs/guides/generate-root.html.md b/website/source/docs/guides/generate-root.html.md new file mode 100644 index 000000000..259c4bf12 --- /dev/null +++ b/website/source/docs/guides/generate-root.html.md @@ -0,0 +1,24 @@ +--- +layout: "docs" +page_title: "Generate Root" +sidebar_current: "docs-guides-generate-root" +description: |- + Generate a new root key using a threshold of unseal keys. +--- + +# Generate a root token (when none exists) + +It's considered [best practice](../concepts/tokens.html#root-tokens) not to +keep root tokens around, as they are all-powerful. Instead, if one is +absolutely needed, create it using Vault's `generate-root` command: + +1. Unseal the vault. You do not need to be authenticated (you do not need an + existing root token). +2. Generate a one-time password with `vault generate-root -genotp`. +3. Get the encoded root token: `vault generate-root -otp ` +(Requires a quorum of unseal keys again, so needs to be done \ times.) +4. Decode the encoded root token with +`vault generate-root -otp -decode= ` + +See `vault generate-root -help` for information on the alternate technique + using a PGP key. diff --git a/website/source/docs/guides/index.html.md b/website/source/docs/guides/index.html.md new file mode 100644 index 000000000..7ea69a86b --- /dev/null +++ b/website/source/docs/guides/index.html.md @@ -0,0 +1,18 @@ +--- +layout: "docs" +page_title: "Guides" +sidebar_current: "docs-guides" +description: |- + This section provides various guides for common actions. Due to the nature of Vault, some of these procedures can be complex, so our goal is to provide guidance to do them safely. +--- + +# Vault Guides + +This section provides various guides for common actions. Due to the nature +of Vault, some of these procedures can be complex, so our goal is to provide +guidance to do them safely. + +The following guides are available: + +* [Generate Root](/docs/guides/generate-root.html) - This guide covers how to +generate new root tokens using unseal keys. diff --git a/website/source/layouts/docs.erb b/website/source/layouts/docs.erb index 0a98c7ac6..90a78dc90 100644 --- a/website/source/layouts/docs.erb +++ b/website/source/layouts/docs.erb @@ -1,233 +1,238 @@ <% wrap_layout :inner do %> - <% content_for :sidebar do %> - - <% end %> - - <%= yield %> + <%= yield %> <% end %>