Merge branch '13647-keepstore-config'

[arvados.git] / lib / config / generated_config.go

diff --git a/lib/config/generated_config.go b/lib/config/generated_config.go
index 117f189d9a533a023c77182535f5f8784461657d..32c101a5a080836aa84a3f2a5d0fc7d244813dda 100644 (file)
--- a/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@ -31,7 +31,13 @@ Clusters:
       # listening, and reachable from other hosts in the cluster.
       SAMPLE:
         InternalURLs:
-          "http://example.host:12345": {}
+          "http://host1.example:12345": {}
+          "http://host2.example:12345":
+            # Rendezvous is normally empty/omitted. When changing the
+            # URL of a Keepstore service, Rendezvous should be set to
+            # the old URL (with trailing slash omitted) to preserve
+            # rendezvous ordering.
+            Rendezvous: ""
           SAMPLE:
             Rendezvous: ""
         ExternalURL: "-"
@@ -319,15 +325,9 @@ Clusters:
       MaxRequestLogParamsSize: 2000
 
     Collections:
-      # Allow clients to create collections by providing a manifest with
-      # unsigned data blob locators. IMPORTANT: This effectively disables
-      # access controls for data stored in Keep: a client who knows a hash
-      # can write a manifest that references the hash, pass it to
-      # collections.create (which will create a permission link), use
-      # collections.get to obtain a signature for that data locator, and
-      # use that signed locator to retrieve the data from Keep. Therefore,
-      # do not turn this on if your users expect to keep data private from
-      # one another!
+
+      # Enable access controls for data stored in Keep. This should
+      # always be set to true on a production cluster.
       BlobSigning: true
 
       # BlobSigningKey is a string of alphanumeric characters used to
@@ -382,10 +382,6 @@ Clusters:
       # still has permission) the client can retrieve the collection again
       # to get fresh signatures.
       #
-      # This must be exactly equal to the -blob-signature-ttl flag used by
-      # keepstore servers.  Otherwise, reading data blocks and saving
-      # collections will fail with HTTP 403 permission errors.
-      #
       # Modifying BlobSigningTTL invalidates existing signatures; see
       # BlobSigningKey note above.
       #
@@ -797,9 +793,24 @@ Clusters:
 
     Volumes:
       SAMPLE:
+        # AccessViaHosts specifies which keepstore processes can read
+        # and write data on the volume.
+        #
+        # For a local filesystem, AccessViaHosts has one entry,
+        # indicating which server the filesystem is located on.
+        #
+        # For a network-attached backend accessible by all keepstore
+        # servers, like a cloud storage bucket or an NFS mount,
+        # AccessViaHosts can be empty/omitted.
+        #
+        # Further info/examples:
+        # https://doc.arvados.org/install/configure-fs-storage.html
+        # https://doc.arvados.org/install/configure-s3-object-storage.html
+        # https://doc.arvados.org/install/configure-azure-blob-storage.html
         AccessViaHosts:
           SAMPLE:
             ReadOnly: false
+          "http://host1.example:25107": {}
         ReadOnly: false
         Replication: 1
         StorageClasses:
@@ -808,7 +819,8 @@ Clusters:
         Driver: s3
         DriverParameters:
 
-          # for s3 driver
+          # for s3 driver -- see
+          # https://doc.arvados.org/install/configure-s3-object-storage.html
           AccessKey: aaaaa
           SecretKey: aaaaa
           Endpoint: ""
@@ -821,7 +833,8 @@ Clusters:
           RaceWindow: 24h
           UnsafeDelete: false
 
-          # for azure driver
+          # for azure driver -- see
+          # https://doc.arvados.org/install/configure-azure-blob-storage.html
           StorageAccountName: aaaaa
           StorageAccountKey: aaaaa
           StorageBaseURL: core.windows.net
@@ -833,7 +846,8 @@ Clusters:
           WriteRaceInterval: 15s
           WriteRacePollTime: 1s
 
-          # for local directory driver
+          # for local directory driver -- see
+          # https://doc.arvados.org/install/configure-fs-storage.html
           Root: /var/lib/arvados/keep-data
           Serialize: false