Skip to content

Commit 56e162e

Browse files
authored
docs: Update KMS docs (#1204)
* docs: Update KMS docs * docs: Adds release notes * docs: Fix table spacing * docs: Minor revision * docs: Revise title * docs: Change file name * docs: Update KMS names on nav for consistency
1 parent 676bf7c commit 56e162e

File tree

4 files changed

+79
-4
lines changed

4 files changed

+79
-4
lines changed
Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
layout: docs
3+
page_title: IBM Key Protect KMS configuration
4+
description: >-
5+
Learn about using the IBM Key Protect KMS for key management and configuring parameters and authentication. View an example configuration.
6+
---
7+
8+
# ibmkp KMS
9+
10+
The IBM KMS configures Boundary to use IBM Key Protect for key management.
11+
12+
## `ibmkp` example
13+
14+
This example shows an IBM KMS stanza in the Boundary configuration file:
15+
16+
````hcl
17+
kms "ibmkp" {
18+
purpose = "root"
19+
api_key = "8uEy9TUDVtUHuUGXpsMlpTb4rp8B_ZEfjU28ujik_nyw"
20+
instance_id = "0647c737-906d-4f4e-8a68-2c187e11b29b"
21+
key_id = "key-protect-key1"
22+
endpoint = "https://cloud.ibm.com"
23+
key_name = "global_worker-auth"
24+
}
25+
````
26+
27+
## `ibmkp` parameters
28+
29+
The IBM KMS uses the following parameters in the `kms` stanza of the Boundary configuration file:
30+
31+
- `purpose` - States the purpose of the KMS, supported values are `worker-auth`, `worker-auth-storage`, `root`, `previous-root`, `recovery`, `bsr`, or `config`.
32+
33+
To enable session recording, you must configure the `bsr` value for the `purpose`.
34+
35+
- `api_key` `(string: "")` - The API key used to authenticate to IBM Cloud services.
36+
You can also specify this value using the `IBMCLOUD_API_KEY` environment variable.
37+
- `instance_id` `(string: <required>)` - The ID for the IBM Key Protect instance.
38+
You can also specify this value using the `IBMCLOUD_KP_INSTANCE_ID` environment variable.
39+
- `key_id` `(string: <required>)` - The IBM Key Protect key to use for encryption and decryption.
40+
You can also specify this value using the `IBMCLOUD_KP_KEY_ID` environment variable.
41+
- `endpoint` `(string: "")` - The KMS API endpoint to use for making IBM KMS requests.
42+
You can also specify this value using the `IBM_KP_ENDPOINT` environment variable.
43+
- `key_name` - The unique name for this key.
44+
It is used to identify the key when you perform a root key migration.
45+
46+
## Authentication
47+
48+
You must provide authentication-related values either as environment variables or as configuration parameters.
49+
50+
The IBM Key Protect authentication values include:
51+
52+
- `IBMCLOUD_API_KEY`
53+
- `IBMCLOUD_KP_INSTANCE_ID`
54+
- `IBMCLOUD_KP_KEY_ID`
55+
- `IBMCLOUD_KP_ENDPOINT`

content/boundary/v0.20.x/content/docs/configuration/kms/index.mdx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,5 +37,6 @@ For specific KMS examples, refer to the following topics:
3737
- [AWS KMS](/boundary/docs/configuration/kms/awskms)
3838
- [Azure Key Vault KMS](/boundary/docs/configuration/kms/azurekeyvault)
3939
- [GCP Cloud KMS](/boundary/docs/configuration/kms/gcpckms)
40+
- [IBM KMS](/boundary/docs/configuration/kms/ibmkp)
4041
- [OCI KMS](/boundary/docs/configuration/kms/ocikms)
4142
- [Vault Transit KMS](/boundary/docs/configuration/kms/transit)

content/boundary/v0.20.x/content/docs/release-notes/v0_20_0.mdx

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,21 @@ description: >-
121121
</td>
122122
</tr>
123123

124+
<tr>
125+
<td style={{verticalAlign: 'middle'}}>
126+
IBM Key Protect KMS support
127+
</td>
128+
<td style={{verticalAlign: 'middle'}}>
129+
GA in version 0.20.1
130+
</td>
131+
<td style={{verticalAlign: 'middle'}}>
132+
Boundary now supports IBM Key Protect for key management.
133+
<br /><br />You can configure IBM Key Protect as the KMS to manage encryption keys for various functions.
134+
<br /><br />
135+
Learn more:&nbsp;<a href="/boundary/docs/secure/encryption/data-encryption">Data encryption in Boundary</a> and <a href="/boundary/docs/configuration/kms/ibmkms">ibmkms KMS</a>.
136+
</td>
137+
</tr>
138+
124139
</tbody>
125140
</table>
126141

content/boundary/v0.20.x/data/docs-nav-data.json

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2087,31 +2087,35 @@
20872087
"path": "configuration/kms"
20882088
},
20892089
{
2090-
"title": "AEAD",
2090+
"title": "AEAD KMS",
20912091
"path": "configuration/kms/aead"
20922092
},
20932093
{
2094-
"title": "AliCloud KMS",
2094+
"title": "AlibabaCloud KMS",
20952095
"path": "configuration/kms/alicloudkms"
20962096
},
20972097
{
20982098
"title": "AWS KMS",
20992099
"path": "configuration/kms/awskms"
21002100
},
21012101
{
2102-
"title": "Azure Key Vault",
2102+
"title": "Azure Key Vault KMS",
21032103
"path": "configuration/kms/azurekeyvault"
21042104
},
21052105
{
21062106
"title": "GCP Cloud KMS",
21072107
"path": "configuration/kms/gcpckms"
21082108
},
2109+
{
2110+
"title": "IBM Key Protect KMS",
2111+
"path": "configuration/kms/ibmkp"
2112+
},
21092113
{
21102114
"title": "OCI KMS",
21112115
"path": "configuration/kms/ocikms"
21122116
},
21132117
{
2114-
"title": "Vault transit",
2118+
"title": "Vault transit KMS",
21152119
"path": "configuration/kms/transit"
21162120
}
21172121
]

0 commit comments

Comments
 (0)