[feat] docs; update admonition syntax (#68842)
* [feat] docs; update admonition syntax - Standardizes according to style conventions: https://grafana.com/docs/writers-toolkit/style-guide/style-conventions/#admonitions - Prepares docs for better, uniform admonition style. * Remove false positives and irregularities * false positive removal * Update docs/sources/datasources/mysql/_index.md * Update docs/sources/developers/angular_deprecation/angular-plugins.md * fix link errors * Prettify some nested blockquotes * remoe unnecessary admonition
This commit is contained in:
+14
-6
@@ -14,15 +14,21 @@ Grafana’s database contains secrets, which are used to query data sources, sen
|
||||
|
||||
Grafana encrypts these secrets before they are written to the database, by using a symmetric-key encryption algorithm called Advanced Encryption Standard (AES). These secrets are signed using a [secret key]({{< relref "../../configure-grafana#secret_key" >}}) that you can change when you configure a new Grafana instance.
|
||||
|
||||
> **Note:** Grafana v9.0 and newer use [envelope encryption](#envelope-encryption) by default, which adds a layer of indirection to the encryption process that introduces an [**implicit breaking change**](#implicit-breaking-change) for older versions of Grafana.
|
||||
{{% admonition type="note" %}}
|
||||
Grafana v9.0 and newer use [envelope encryption](#envelope-encryption) by default, which adds a layer of indirection to the encryption process that introduces an [**implicit breaking change**](#implicit-breaking-change) for older versions of Grafana.
|
||||
{{% /admonition %}}
|
||||
|
||||
For further details about how to operate a Grafana instance with envelope encryption, see the [Operational work]({{< relref "#operational-work" >}}) section.
|
||||
|
||||
> **Note:** In Grafana Enterprise, you can also [encrypt secrets in AES-GCM (Galois/Counter Mode)]({{< relref "#changing-your-encryption-mode-to-aes-gcm" >}}) instead of the default AES-CFB (Cipher FeedBack mode).
|
||||
{{% admonition type="note" %}}
|
||||
In Grafana Enterprise, you can also [encrypt secrets in AES-GCM (Galois/Counter Mode)]({{< relref "#changing-your-encryption-mode-to-aes-gcm" >}}) instead of the default AES-CFB (Cipher FeedBack mode).
|
||||
{{% /admonition %}}
|
||||
|
||||
## Envelope encryption
|
||||
|
||||
> **Note:** Since Grafana v9.0, you can turn envelope encryption off by adding the feature toggle `disableEnvelopeEncryption` to your [Grafana configuration]({{< relref "../../configure-grafana#feature_toggles" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
Since Grafana v9.0, you can turn envelope encryption off by adding the feature toggle `disableEnvelopeEncryption` to your [Grafana configuration]({{< relref "../../configure-grafana#feature_toggles" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
Instead of encrypting all secrets with a single key, Grafana uses a set of keys called data encryption keys (DEKs) to encrypt them. These data encryption keys are themselves encrypted with a single key encryption key (KEK), configured through the `secret_key` attribute in your
|
||||
[Grafana configuration]({{< relref "../../configure-grafana#secret_key" >}}) or by [Encrypting your database with a key from a key management service (KMS)](#encrypting-your-database-with-a-key-from-a-key-management-service-kms).
|
||||
@@ -69,9 +75,11 @@ You can rotate data keys to disable the active data key and therefore stop using
|
||||
|
||||
New data keys for encryption operations are generated on demand.
|
||||
|
||||
> **Note:** Data key rotation does **not** implicitly re-encrypt secrets. Grafana will continue to use rotated data keys to decrypt
|
||||
> secrets still encrypted with them. To completely stop using
|
||||
> rotated data keys for both encryption and decryption, see [secrets re-encryption](#re-encrypt-secrets).
|
||||
{{% admonition type="note" %}}
|
||||
Data key rotation does **not** implicitly re-encrypt secrets. Grafana will continue to use rotated data keys to decrypt
|
||||
secrets still encrypted with them. To completely stop using
|
||||
rotated data keys for both encryption and decryption, see [secrets re-encryption](#re-encrypt-secrets).
|
||||
{{% /admonition %}}
|
||||
|
||||
To rotate data keys, use the `/encryption/rotate-data-keys` endpoint of the Grafana [Admin API]({{< relref "../../../developers/http_api/admin#rotate-data-encryption-keys" >}}). It's safe to call more than once, more recommended under maintenance mode.
|
||||
|
||||
|
||||
+7
-3
@@ -11,10 +11,14 @@ weight: 500
|
||||
|
||||
If you manage your secrets with [Hashicorp Vault](https://www.hashicorp.com/products/vault), you can use them for [Configuration]({{< relref "../../../configure-grafana" >}}) and [Provisioning]({{< relref "../../../../administration/provisioning" >}}).
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
|
||||
> **Note:** If you have Grafana [set up for high availability]({{< relref "../../../set-up-for-high-availability" >}}), then we advise not to use dynamic secrets for provisioning files.
|
||||
> Each Grafana instance is responsible for renewing its own leases. Your data source leases might expire when one of your Grafana servers shuts down.
|
||||
{{% admonition type="note" %}}
|
||||
If you have Grafana [set up for high availability]({{< relref "../../../set-up-for-high-availability" >}}), then we advise not to use dynamic secrets for provisioning files.
|
||||
Each Grafana instance is responsible for renewing its own leases. Your data source leases might expire when one of your Grafana servers shuts down.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Configuration
|
||||
|
||||
|
||||
Reference in New Issue
Block a user