scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-02 11:38:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update kmip.mdx (#24159)

Browse Source 
* Update kmip.mdx

Added "performance standby" to the servers the KMIP client can connect to

---------

Co-authored-by: Peter Wilson <peter.wilson@hashicorp.com>
This commit is contained in:
gabeknell
2024-05-02 12:01:58 -04:00
committed by GitHub
parent 3282554d7a
commit de11f27713
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
website/content/docs/secrets/kmip.mdx
View File

@@ -18,7 +18,18 @@ services and applications to perform cryptographic operations without having to
manage cryptographic material, otherwise known as managed objects, by delegating
its storage and lifecycle to a key management server.
Vault's KMIP secrets engine listens on a separate port from the standard Vault listener. Each Vault server in a Vault cluster configured with a KMIP secrets engine uses the same listener configuration. The KMIP listener defaults to port 5696 and is configurable to alternative ports, for example, if there are multiple KMIP secrets engine mounts configured. KMIP clients connect and authenticate to this KMIP secrets engine listener port using generated TLS certificates. KMIP clients may connect directly to any of the Vault servers on the configured KMIP port. A layer 4 TCP load balancer may be used in front of the Vault server's KMIP ports. The load balancer should support long-lived connections and it may use a round robin routing algorithm as Vault servers will forward to the primary Vault server, if necessary.
Vault's KMIP secrets engine listens on a separate port from the standard Vault
listener. Each Vault server in a Vault cluster configured with a KMIP secrets
engine uses the same listener configuration. The KMIP listener defaults to port
5696 and is configurable to alternative ports, for example, if there are
multiple KMIP secrets engine mounts configured. KMIP clients connect and
authenticate to this KMIP secrets engine listener port using generated TLS
certificates. KMIP clients may connect directly to the Vault active server, or
any of the Vault performance standby servers, on the configured KMIP port. A
layer 4 tcp load balancer may be used in front of the Vault server's KMIP ports.
The load balancer should support long-lived connections and it may use a round
robin routing algorithm as Vault servers will forward to the primary Vault
server, if necessary.
## KMIP conformance