Docs: vault kv and transit engine updates

Providing some clearer documentation on the steps needed when using either the kv or transit engine

Signed-off-by: ianwatsonrh <ianwatson@redhat.com>

diff --git a/doc/radosgw/vault.rst b/doc/radosgw/vault.rst
index dc3ec3ddfb6e24606f33d27a09446e4344c09e41..c952324daa985bca1cadb7090302962a74daf384 100644 (file)
--- a/doc/radosgw/vault.rst
+++ b/doc/radosgw/vault.rst
@@ -61,7 +61,7 @@ KV secrets engine
 The KV secrets engine is used to store arbitrary key/value secrets in Vault. To
 enable the KV engine version 2 in Vault, use the following command::
 
-  vault secrets enable kv-v2
+  vault secrets enable -path secret kv-v2
 
 The Object Gateway can be configured to use the KV engine version 2 with the
 following setting::
@@ -266,9 +266,13 @@ Upload object
 =============
 
 When uploading an object to the Gateway, provide the SSE key ID in the request.
-As an example, using the AWS command-line client::
+As an example, for the kv engine, using the AWS command-line client::
 
   aws --endpoint=http://radosgw:8000 s3 cp plaintext.txt s3://mybucket/encrypted.txt --sse=aws:kms --sse-kms-key-id myproject/mybucketkey
+  
+As an example, for the transit engine, using the AWS command-line client::
+
+  aws --endpoint=http://radosgw:8000 s3 cp plaintext.txt s3://mybucket/encrypted.txt --sse=aws:kms --sse-kms-key-id mybucketkey/1
 
 The Object Gateway will fetch the key from Vault, encrypt the object and store
 it in the bucket. Any request to download the object will make the Gateway
@@ -276,11 +280,16 @@ automatically retrieve the correspondent key from Vault and decrypt the object.
 
 Note that the secret will be fetched from Vault using a URL constructed by
 concatenating the base address (``rgw crypt vault addr``), the (optional)
-URL prefix (``rgw crypt vault prefix``), and finally the key ID. In the example
-above, the Gateway would fetch the secret from::
+URL prefix (``rgw crypt vault prefix``), and finally the key ID. 
+
+In the kv engine example above, the Gateway would fetch the secret from::
 
   http://vaultserver:8200/v1/secret/data/myproject/mybucketkey
 
+In the transit engine example above, the Gateway would fetch the secret from::
+
+  http://vaultserver:8200/v1/transit/export/encryption-key/mybucketkey/1
+
 .. _Server-Side Encryption: ../encryption
 .. _Vault: https://www.vaultproject.io/docs/
 .. _Token authentication method: https://www.vaultproject.io/docs/auth/token.html