docs: document Zero --security token and whitelist flags#762
Open
matthewmcneely wants to merge 1 commit into
Open
docs: document Zero --security token and whitelist flags#762matthewmcneely wants to merge 1 commit into
matthewmcneely wants to merge 1 commit into
Conversation
Zero now supports the --security superflag (token, whitelist) to authenticate its administrative HTTP endpoints (/state, /assign, /removeNode, /moveTablet). Document the flag on the dgraph zero CLI page, add zero to the Security superflag table, and add a "Zero admin endpoints" section to Admin Endpoint Security describing the two-tier protection: /removeNode and /moveTablet are loopback-only by default, while /state and /assign are enforced once a token or whitelist is set. Applied to both docs/ (next) and the served v25.3 version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collaborator
Author
|
Merge only when v25.3.9 is released. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the
--securitysuperflag ondgraph zero, which authenticates Zero's administrative HTTP endpoints (/state,/assign,/removeNode,/moveTablet) using the sametokenandwhitelistoptions Alpha already supports.What changed
cli/zero.md— adds--securityto the superflag list, a new "Securing the admin HTTP endpoints" section with usage examples, and the flag block in the Full Reference.cli/superflags.md— the Security superflagtokenandwhitelistoptions now listzerounder "Applies to", with a pointer to the admin-endpoint-security page.admin/security/admin-endpoint-security.md— a new "Zero admin endpoints" section describing how the flag protects these endpoints.Behavior documented
/removeNode,/moveTablet) are restricted to loopback by default. Awhitelistortokenis required to reach them from another host./state,/assign) are enforced once atokenorwhitelistis configured.--limit "disable-admin-http=true"turns the endpoints off entirely.Notes
docs/(next) anddocs_versioned_docs/version-v25.3/(the version served as latest, perincludeCurrentVersion: false+lastVersion: 'v25.3').--securityflag on Zero is being added in dgraph; this documents it. Best merged alongside that release.🤖 Generated with Claude Code