DOC-14248-Encryption-At-Rest-Backup1#4131
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Backup & Restore management documentation to add guidance for “encryption at rest” support in backup repositories and to refresh various UI/prose descriptions in the same page.
Changes:
- Adds new sections describing backup encryption-at-rest concepts, supported workflows, repository configuration, and restore behavior for encrypted repositories.
- Updates a number of UI-instruction sentences (including terminology such as “dropdown menu”) and revises various occurrences of “one” → “1”.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| + | ||
| Click the control that appears at the right-hand side of the *Select plan* dialog's interactive text-field. | ||
| A pull-down menu appears with the following options: | ||
| A dropdown menu appears with the following options: |
There was a problem hiding this comment.
mixed terminology used across CB docs. Leaving this as is for now.
| Alternatively, to choose a specific frequency, access the control on the *Period* field. | ||
| A dropdown menu appears: |
There was a problem hiding this comment.
not adding "right-hand" side as per Vale flagging and leaving drop down as is for now.
There was a problem hiding this comment.
The sentence can end with a period. No need of : "A dropdown menu appears:"
We can say "A dropdown menu appears."
| image::manage-backup-restore/periodPullDownMenu.png[,420,align=left] | ||
| + | ||
| From the pull-down menu, select *Hours*, to set the frequency is in units of hours. | ||
| From the dropdown menu, select *Hours*, to set the frequency is in units of hours. |
There was a problem hiding this comment.
mixed terminology used across CB docs. Leaving this as is for now.
There was a problem hiding this comment.
Somehow, the above sentence is not sounding correct. I feel it should be changed to one of the following:
Option 1: "From the dropdown menu, select Hours to set the frequency in units of hours."
Option 2: "Select Hours from the dropdown menu to measure the frequency in hours."
Option 3: "From the dropdown menu, select Hours. This sets the frequency unit to hours."
| These can be used to search for a specific document within the repository. | ||
| Optionally, the subset of backups within the repository can be specified, by means of the *Start* and *End* fields. | ||
| For example, by accessing the control at the left-hand side of the *Start* field, a pull-down menu is displayed: this lists backups any one of which can be used as the starting point for the search. | ||
| For example, by accessing the control at the left-hand side of the *Start* field, a dropdown menu is displayed: this lists backups any 1 of which can be used as the starting point for the search. |
There was a problem hiding this comment.
mixed terminology used across CB docs. Leaving this as is for now.
There was a problem hiding this comment.
Will it be better if we write the above as "For example, by accessing the control on the left-hand side of the Start field, a dropdown menu is displayed, listing backups. Any of these can be used as the starting point for the search."
|
|
||
| . To specify the first backup, access the interactive control at the right-hand side of the *Start* field. | ||
| This produces a pull-down menu that displays all available backups for this repository: | ||
| This produces a dropdown menu that displays all available backups for this repository: |
There was a problem hiding this comment.
mixed terminology used across CB docs. Leaving this as is for now.
There was a problem hiding this comment.
It is better to end the sentence with a period and not :
|
|
||
| . Select a backup that will be the starting backup for the merge. | ||
| Then, access the control at the right-hand side of the *End* field, and select, from its pull-down menu, a backup that will be the ending backup for the merge. | ||
| Then, access the control at the right-hand side of the *End* field, and select, from its dropdown menu, a backup that will be the ending backup for the merge. |
There was a problem hiding this comment.
mixed terminology used across CB docs. Leaving this as is for now.
| image:manage-backup-restore/scheduleOptionsMenu.png[,420,align=left] | ||
|
|
||
| The pull-down menu thus displayed contains three kinds of scheduling option. | ||
| The dropdown menu thus displayed contains three kinds of scheduling option. |
There was a problem hiding this comment.
mixed terminology used across CB docs. Leaving this as is for now.
There was a problem hiding this comment.
The dropdown menu contains three kinds of scheduling options.
updated based on copilot comments
|
I couldn't see/view the preview as to how it appears on the web. However, have edited it here only. My edits are generic. Feel free to keep the nomenclature as dropdown or pull-down, consistently throughout the doc. |
|
|
||
| * The machine performing the restore must still have access to the original KMS key used to encrypt the repository. | ||
|
|
||
| * Encryption-at-rest settings are not backed up or restored as part of the bucket configuration. If you need encryption at rest on the target cluster, configure it separately. |
There was a problem hiding this comment.
| * Encryption-at-rest settings are not backed up or restored as part of the bucket configuration. If you need encryption at rest on the target cluster, configure it separately. | |
| * Encryption-at-rest settings are not restored as part of the bucket configuration. If you need encryption at rest on the target cluster, configure it separately. |
nit: they are technically backed up.
|
|
||
| * Key Encryption Keys (KEKs) — The repository encryption key is itself encrypted (enveloped) using either a passphrase-derived key or an external key from a Key Management Service (KMS). | ||
|
|
||
| For more information about the core encryption-at-rest architecture, including DEKs and KEKs, see xref:learn/security/encryption-at-rest-keys.adoc[Encryption at Rest Keys]. |
There was a problem hiding this comment.
This is very slightly misleading - the encryption-at-rest configuration for the rest of server (what I assume this links to) is completely separate to the backup configuration. This should be made clear in the docs
| Encryption at rest for backups uses an envelope encryption model: | ||
| * Repository Encryption Key — An auto-generated encryption key that is used to encrypt the actual backup data. This key is created when the encrypted repository is configured. | ||
|
|
||
| * Data Encryption Keys (DEKs) — Derived keys are created per backup, per bucket, and per vBucket to avoid issues with repeated nonces. This ensures cryptographic safety even for very large datasets. |
There was a problem hiding this comment.
-
There are no per-backup level keys
-
The bucket keys are randomly generated, not derived from another key.
|
|
||
| When you restore from an encrypted repository, cbbackupmgr or the Backup Service: | ||
| . Connects to the KMS (or uses the passphrase) to decrypt the repository encryption key. | ||
| . Uses the decrypted repository key to derive per-backup, per-bucket, and per-vBucket decryption keys. |
There was a problem hiding this comment.
There are no per-backup keys.
Also, I feel that:
| . Uses the decrypted repository key to derive per-backup, per-bucket, and per-vBucket decryption keys. | |
| . Uses the decrypted repository key to obtain per-bucket and per-vBucket decryption keys. |
would be more accurate; the per-bucket key isn't derived - it's decrypted, and the per-vBucket keys are then derived from that
No description provided.