Config credentials: reference

Author: andreyaksenov

doc/reference/configuration/configuration_reference.rst

@@ -361,7 +361,7 @@ The ``config`` section defines various parameters related to centralized configu
 config.context.*
 ~~~~~~~~~~~~~~~~
 
-This section describes options related to loading configuration settings from external storage.
+This section describes options related to loading configuration settings from external storage such as external files or environment variables.
 
 *   :ref:`config.context <configuration_reference_config_context>`
 
@@ -379,11 +379,6 @@ This section describes options related to loading configuration settings from ex
     **Since:** :doc:`3.0.0 </release/3.0.0>`.
 
     Specify how to load settings from external storage.
-    There are the following storage types:
-
-    *   file
-    *   environment variable
-
     For example, this option can be used to load passwords from safe storage.
     You can find the examples in :ref:`configuration_credentials_loading_secrets`.
 
@@ -397,26 +392,60 @@ This section describes options related to loading configuration settings from ex
 
 ..  confval:: config.context.<name>
 
+    The name of an entity that identifies a configuration value to load.
 
 ..  _configuration_reference_config_context_name_env:
 
 ..  confval:: config.context.<name>.env
 
+    The name of an environment variable to load a configuration value from.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials_context_env/config.yaml
+        :language: yaml
+        :start-at: config:
+        :end-before: credentials:
+        :dedent:
+
+    See also: :ref:`configuration_credentials_loading_secrets`.
+
 
 ..  _configuration_reference_config_context_name_from:
 
 ..  confval:: config.context.<name>.from
 
+    The type of storage to load a configuration value from.
+    There are the following storage types:
+
+    *   ``file``: load a configuration value from a file.
+        In this case, you need to specify the path to the file using :ref:`config.context.\<name\>.file <configuration_reference_config_context_name_file>`.
+    *   ``env``: load a configuration value from an environment variable.
+        In this case, specify the environment variable name using :ref:`config.context.\<name\>.env <configuration_reference_config_context_name_env>`.
+
 
 ..  _configuration_reference_config_context_name_file:
 
 ..  confval:: config.context.<name>.file
 
+    The path to a file to load a configuration value from.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials_context_file/config.yaml
+        :language: yaml
+        :start-at: config:
+        :end-before: credentials:
+        :dedent:
+
+    See also: :ref:`configuration_credentials_loading_secrets`.
+
 
 ..  _configuration_reference_config_context_name_rstrip:
 
 ..  confval:: config.context.<name>.rstrip
 
+    Whether to strip whitespace characters and newlines from the end of data.
 
 
 
@@ -610,7 +639,8 @@ This section describes options related to :ref:`storing configuration in etcd <c
 credentials
 -----------
 
-..  TODO: https://github.com/tarantool/doc/issues/3666
+The ``credentials`` section allows you to create users and grant them the specified privileges.
+Learn more in :ref:`configuration_credentials`.
 
 .. NOTE::
 
@@ -626,6 +656,18 @@ credentials
 
 .. confval:: credentials.roles
 
+    An array of :ref:`roles <access_control_concepts_roles>` that can be granted to users.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
+        :language: yaml
+        :start-after: spaces: [ books ]
+        :end-at: spaces: [ writers ]
+        :dedent:
+
+    See also: :ref:`configuration_credentials_managing_users_roles`.
+
     | Type: map
     | Default: nil
     | Environment variable: TT_CREDENTIALS_ROLES
@@ -635,6 +677,18 @@ credentials
 
 .. confval:: credentials.users
 
+    An array :ref:`users <access_control_concepts_users>`.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
+        :language: yaml
+        :start-at: credentials:
+        :end-at: T0p_Secret
+        :dedent:
+
+    See also: :ref:`configuration_credentials_managing_users_roles`.
+
     | Type: map
     | Default: nil
     | Environment variable: TT_CREDENTIALS_USERS
@@ -650,12 +704,15 @@ credentials.roles.*
 
 .. confval:: credentials.roles.<role_name>.roles
 
+    An array of :ref:`roles <access_control_concepts_roles>` granted to this role.
 
 .. _configuration_reference_credentials_roles_name_privileges:
 
 .. confval:: credentials.roles.<role_name>.privileges
 
-    See :ref:`privileges <configuration_reference_credentials_privileges>`.
+    An array of :ref:`privileges <authentication-owners_privileges>` granted to this role.
+
+    See :ref:`\<user_or_role_name\>.privileges.* <configuration_reference_credentials_privileges>`.
 
 
 ..  _configuration_reference_credentials_user:
@@ -668,17 +725,31 @@ credentials.users.*
 
 .. confval:: credentials.users.<username>.password
 
+    A user's password.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
+        :language: yaml
+        :start-at: credentials:
+        :end-at: T0p_Secret
+        :dedent:
+
+    See also: :ref:`configuration_credentials_loading_secrets`.
 
 .. _configuration_reference_credentials_users_name_roles:
 
 .. confval:: credentials.users.<username>.roles
 
+    An array of :ref:`roles <access_control_concepts_roles>` granted to this user.
 
 .. _configuration_reference_credentials_users_name_privileges:
 
 .. confval:: credentials.users.<username>.privileges
 
-    See :ref:`privileges <configuration_reference_credentials_privileges>`.
+    An array of :ref:`privileges <authentication-owners_privileges>` granted to this user.
+
+    See :ref:`\<user_or_role_name\>.privileges.* <configuration_reference_credentials_privileges>`.
 
 
 ..  _configuration_reference_credentials_privileges:
@@ -690,36 +761,69 @@ credentials.users.*
 
 .. confval:: <user_or_role_name>.privileges.permissions
 
+    Permissions assigned to this user or a user with this role.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
+        :language: yaml
+        :start-at: sampleuser:
+        :end-at: [ books ]
+        :dedent:
+
+    See also: :ref:`configuration_credentials_managing_users_roles`.
 
 .. _configuration_reference_credentials_users_name_privileges_spaces:
 
 .. confval:: <user_or_role_name>.privileges.spaces
 
+    Spaces to which this user or a user with this role gets the specified permissions.
+
+    **Example:**
+
+    ..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
+        :language: yaml
+        :start-at: sampleuser:
+        :end-at: [ books ]
+        :dedent:
+
+    See also: :ref:`configuration_credentials_managing_users_roles`.
+
 
 .. _configuration_reference_credentials_users_name_privileges_functions:
 
 .. confval:: <user_or_role_name>.privileges.functions
 
+    Functions to which this user or a user with this role gets the specified permissions.
+
 
 .. _configuration_reference_credentials_users_name_privileges_sequences:
 
 .. confval:: <user_or_role_name>.privileges.sequences
 
+    Sequences to which this user or a user with this role gets the specified permissions.
+
 
 .. _configuration_reference_credentials_users_name_privileges_lua_eval:
 
 .. confval:: <user_or_role_name>.privileges.lua_eval
 
+    Whether this user or a user with this role can execute arbitrary Lua code.
+
 
 .. _configuration_reference_credentials_users_name_privileges_lua_call:
 
 .. confval:: <user_or_role_name>.privileges.lua_call
 
+    Whether this user or a user with this role can call any global user-defined Lua function.
+
 
 .. _configuration_reference_credentials_users_name_privileges_sql:
 
 .. confval:: <user_or_role_name>.privileges.sql
 
+    Whether this user or a user with this role can can execute an arbitrary SQL expression.
+