From 511aaf4d5d3f3f0380c530f534100b8cedc99832 Mon Sep 17 00:00:00 2001 From: Anthony Date: Wed, 16 Aug 2017 15:10:25 +0800 Subject: [PATCH] Update encrypt-data.md add ":" to the sentence --- docs/tasks/administer-cluster/encrypt-data.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/tasks/administer-cluster/encrypt-data.md b/docs/tasks/administer-cluster/encrypt-data.md index f024f58066..d7644e0f77 100644 --- a/docs/tasks/administer-cluster/encrypt-data.md +++ b/docs/tasks/administer-cluster/encrypt-data.md @@ -83,7 +83,7 @@ is the first provider, the first key is used for encryption. ## Encrypting your data -Create a new encryption config file +Create a new encryption config file: ```yaml kind: EncryptionConfig @@ -107,9 +107,9 @@ To create a new secret perform the following steps: head -c 32 /dev/urandom | base64 ``` -2. Place that value in the secret field. -3. Set the `--experimental-encryption-provider-config` flag on the `kube-apiserver` to point to the location of the config file -4. Restart your API server. +2. Place that value in the secret field. +3. Set the `--experimental-encryption-provider-config` flag on the `kube-apiserver` to point to the location of the config file. +4. Restart your API server. **IMPORTANT:** Your config file contains keys that can decrypt content in etcd, so you must properly restrict permissions on your masters so only the user who runs the kube-apiserver can read it. @@ -168,7 +168,7 @@ the presence of a highly available deployment where multiple `kube-apiserver` pr 5. Run `kubectl get secrets -o json | kubectl replace -f -` to encrypt all existing secrets with the new key 6. Remove the old decryption key from the config after you back up etcd with the new key in use and update all secrets -With a single `kube-apiserver`, step 2 may be skipped +With a single `kube-apiserver`, step 2 may be skipped. ## Decrypting all data