16347: Change default to enable local keepstore when possible.

[arvados.git] / lib / config / generated_config.go

diff --git a/lib/config/generated_config.go b/lib/config/generated_config.go
index dfa406bbe63a4887ca10ac40e6d24165257176d3..4742c640587c4cbbda4b477f35b3cfbb2934587b 100644 (file)
--- a/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@ -926,14 +926,32 @@ Clusters:
       #
       # A zero value disables this feature.
       #
-      # This feature has security implications. (1) Container logs
-      # will include keepstore log files, which typically reveal some
-      # volume configuration details, error messages from the cloud
-      # storage provider, etc., which are not otherwise visible to
-      # users. (2) The entire cluster configuration file, including
-      # the system root token, is copied to the worker node and held
-      # in memory for the duration of the container.
-      LocalKeepBlobBuffersPerVCPU: 0
+      # In order for this feature to be activated, no volume may use
+      # AccessViaHosts, and each volume must have Replication higher
+      # than Collections.DefaultReplication. If these requirements are
+      # not satisfied, the feature is disabled automatically
+      # regardless of the value given here.
+      #
+      # Note that when this configuration is enabled, the entire
+      # cluster configuration file, including the system root token,
+      # is copied to the worker node and held in memory for the
+      # duration of the container.
+      LocalKeepBlobBuffersPerVCPU: 1
+
+      # When running a dedicated keepstore process for a container
+      # (see LocalKeepBlobBuffersPerVCPU), write keepstore log
+      # messages to keepstore.txt in the container's log collection.
+      #
+      # These log messages can reveal some volume configuration
+      # details, error messages from the cloud storage provider, etc.,
+      # which are not otherwise visible to users.
+      #
+      # Accepted values:
+      # * "none" -- no keepstore.txt file
+      # * "all" -- all logs, including request and response lines
+      # * "errors" -- all logs except "response" logs with 2xx
+      #   response codes and "request" logs
+      LocalKeepLogsToContainerLog: none
 
       Logging:
         # When you run the db:delete_old_container_logs task, it will find