DOC-14243-Cluster-Management

[supritha-kumar]

Sub branch for documenting Cluster Management

[sarahlwelton]

I'm not going to review all of this right now as I feel I'm addressing a lot of the same issues throughout, and I don't want to overwhelm with comments.

I can keep going if you like, but this needs a lot of work from a style and a content architecture position. There's some weird formatting decisions being made here, too.

[sarahlwelton]

Do you want all of these to be at the same level as "Encryption Keys" in the nav?

[sarahlwelton]

I don't think you really need to set a direct link on the title of a page? Why is it an H2 heading anyway?

[sarahlwelton]

Can we call this "service-generated data" instead of "other," then?

[sarahlwelton]

This is significant enough and, I imagine, enough of a different workflow that it might be worth putting into a separate topic?

Again, this is a huge page and we could probably make it easier to navigate with tabs.

[sarahlwelton]

Again, might be better as a separate page.

[supritha-kumar]

I'm not going to review all of this right now as I feel I'm addressing a lot of the same issues throughout, and I don't want to overwhelm with comments.

I can keep going if you like, but this needs a lot of work from a style and a content architecture position. There's some weird formatting decisions being made here, too.

Hey Sarah, thank you for taking the time to review. A lil unsure why you got around to it despite me clearly calling out that I haven't had the time to do a self-review and changes still need to be made.
I will do the needful before the GA. Thanks!

[Copilot]

Pull request overview

This PR adds and reorganizes documentation for native Encryption at Rest (including key management providers, operational procedures, and conceptual overviews) and wires the new content into the main navigation.

Changes:

• Expanded the Learn > Security > Encryption navigation with new Encryption at Rest subtopics.
• Split/manage Encryption at Rest operational guidance into dedicated Manage pages (encrypting data, rotating keys, dropping DEKs).
• Added new Learn pages covering key hierarchy concepts, KMS providers, rotation/expiration, monitoring, and transparency/performance.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 23 comments.

Show a summary per file

File	Description
modules/ROOT/nav.adoc	Adds new Learn/Manage nav entries for Encryption at Rest topics.
modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc	Updates KMS provider list and restructures/create-key guidance.
modules/manage/pages/manage-security/encrypt-data-at-rest.adoc	New Manage procedure page for enabling encryption for buckets/system data.
modules/manage/pages/manage-security/manually-rotate-encryption-atrest-keys.adoc	New Manage procedure page for manual key rotation across providers.
modules/manage/pages/manage-security/manually-drop-DEKs-reencrypt-data.adoc	New Manage procedure page for drop-DEKs re-encryption and key deletion.
modules/learn/pages/security/native-encryption-at-rest-overview.adoc	Reworks the feature overview (what’s protected, comparisons, availability).
modules/learn/pages/security/encryption-at-rest-keys.adoc	New Learn page explaining KEK/DEK hierarchy and key usage concepts.
modules/learn/pages/security/encryption-key-management-services.adoc	New Learn reference describing supported KMS providers and best practices.
modules/learn/pages/security/multiple-KMS-multiple-keys.adoc	New Learn page describing multi-KMS architectures and rotation behavior.
modules/learn/pages/security/encryption-key-rotation-expiration.adoc	New Learn page detailing rotation vs re-encryption and operational impacts.
modules/learn/pages/security/when-CBServer-encrypts-data.adoc	New Learn page explaining encryption timing/states and enable/disable behavior.
modules/learn/pages/security/per-node-per-bucket.adoc	New Learn page describing per-node/per-bucket/per-data-type principles.
modules/learn/pages/security/transparent-encryption-decryption.adoc	New Learn page describing transparent read/write paths and performance notes.
modules/learn/pages/security/master-password-encryption-at-rest.adoc	New Learn page covering master password role, setup, and rotation.
modules/learn/pages/security/key-health-monitoring-alerts.adoc	New Learn page describing testing, alerts, metrics, and diagnostics.

Comments suppressed due to low confidence (2)

modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc:60

• These xrefs point to native-encryption-at-rest-overview.adoc#kms and #keys, but that overview page no longer defines those anchors in this PR. As a result, both links will be broken.

See xref:learn:security/native-encryption-at-rest-overview.adoc#kms[Encryption Key Management Services] for more information.

You must decide what data your encryption key can encrypt. 
You can create an encryption key that can encrypt any type of data and other encryption keys.
You can also choose to limit what types of data the key can encrypt, or configure it to only encrypt other encryption keys. 
See xref:learn:security/native-encryption-at-rest-overview.adoc#keys[Encryption-at-Rest Keys] for more information.

modules/learn/pages/security/per-node-per-bucket.adoc:76

• This xref points to manage-security/manage-encryption-at-rest.adoc, but that page does not exist. It also has a trailing space before the period. This will render as a broken link.

  configuration, log, and audit data (in the `info` field).

For more information, see xref:manage:manage-security/manage-encryption-at-rest.adoc[Manage Native Encryption at Rest] .

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.