17151: Merge branch 'master'

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>

diff --combined doc/install/install-api-server.html.textile.liquid
index 2893111e3517402af06366978585b8be082b6436,c7303bbba28914ca3ab8be9d5a9e151afa8f83a3..ca55be53e332f12196b359b17a711e5b13c495fc
--- 1/doc/install/install-api-server.html.textile.liquid
--- 2/doc/install/install-api-server.html.textile.liquid
+++ b/doc/install/install-api-server.html.textile.liquid
@@@ -48,21 -48,23 +48,20 @@@ h3. Token
  <notextile>
  <pre><code>    SystemRootToken: <span class="userinput">"$system_root_token"</span>
      ManagementToken: <span class="userinput">"$management_token"</span>
 -    API:
 -      RailsSessionSecretToken: <span class="userinput">"$rails_secret_token"</span>
      Collections:
-       BlobSigningKey: <span class="userinput">"blob_signing_key"</span>
+       BlobSigningKey: <span class="userinput">"$blob_signing_key"</span>
  </code></pre>
  </notextile>
  
- @SystemRootToken@ is used by Arvados system services to authenticate as the system (root) user when communicating with the API server.
+ These secret tokens are used to authenticate messages between Arvados components.
+ * @SystemRootToken@ is used by Arvados system services to authenticate as the system (root) user when communicating with the API server.
+ * @ManagementToken@ is used to authenticate access to system metrics.
 -* @API.RailsSessionSecretToken@ is used to sign session cookies.
+ * @Collections.BlobSigningKey@ is used to control access to Keep blocks.
  
- @ManagementToken@ is used to authenticate access to system metrics.
- 
- @Collections.BlobSigningKey@ is used to control access to Keep blocks.
- 
- You can generate a random token for each of these items at the command line like this:
+ Each token should be a string of at least 50 alphanumeric characters. You can generate a suitable token with the following command:
  
  <notextile>
- <pre><code>~$ <span class="userinput">tr -dc 0-9a-zA-Z &lt;/dev/urandom | head -c50; echo</span>
+ <pre><code>~$ <span class="userinput">tr -dc 0-9a-zA-Z &lt;/dev/urandom | head -c50 ; echo</span>
  </code></pre>
  </notextile>
  

diff --combined lib/config/config.default.yml
index 5763b595d23469acf2347d9e59e020a5fea4a06a,7e16688d9d0b3277dfb9d5f58cb6beab7b09946d..2aa53a4329a9091ef1c5d10a91c0f134568f314a
--- 1/lib/config/config.default.yml
--- 2/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@@ -12,6 -12,8 +12,8 @@@
  
  Clusters:
    xxxxx:
+     # Token used internally by Arvados components to authenticate to
+     # one another. Use a string of at least 50 random alphanumerics.
      SystemRootToken: ""
  
      # Token to be included in all healthcheck requests. Disabled by default.
@@@ -212,6 -214,11 +214,6 @@@
        # serving a single incoming multi-cluster (federated) request.
        MaxRequestAmplification: 4
  
 -      # RailsSessionSecretToken is a string of alphanumeric characters
 -      # used by Rails to sign session tokens. IMPORTANT: This is a
 -      # site secret. It should be at least 50 characters.
 -      RailsSessionSecretToken: ""
 -
        # Maximum wall clock time to spend handling an incoming request.
        RequestTimeout: 5m
  

diff --combined lib/config/generated_config.go
index aeae214ef35edfb25d20fcb7293ce1bdb0d7056e,934131bd8fd90e0085de2532e7f86e43f0709563..34f0a0c92b24d0c8f28a10b4fb1da66c0717edca
--- 1/lib/config/generated_config.go
--- 2/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@@ -18,6 -18,8 +18,8 @@@ var DefaultYAML = []byte(`# Copyright (
  
  Clusters:
    xxxxx:
+     # Token used internally by Arvados components to authenticate to
+     # one another. Use a string of at least 50 random alphanumerics.
      SystemRootToken: ""
  
      # Token to be included in all healthcheck requests. Disabled by default.
@@@ -218,6 -220,11 +220,6 @@@
        # serving a single incoming multi-cluster (federated) request.
        MaxRequestAmplification: 4
  
 -      # RailsSessionSecretToken is a string of alphanumeric characters
 -      # used by Rails to sign session tokens. IMPORTANT: This is a
 -      # site secret. It should be at least 50 characters.
 -      RailsSessionSecretToken: ""
 -
        # Maximum wall clock time to spend handling an incoming request.
        RequestTimeout: 5m