diff --git a/docs/enterprise/concepts.md b/docs/enterprise/concepts.md index 7da52de15..bfefcd109 100644 --- a/docs/enterprise/concepts.md +++ b/docs/enterprise/concepts.md @@ -96,9 +96,9 @@ You may encounter a situation where you may want to add users that are not direc - Create a group within your identity provider directly with the non-domain users in it. This group can be found and added to Namespaces and Policies. - Manually add the user's unique ID. Identify the ID from a user's Session Details page, or the [Sessions](/enterprise/reference/reports.md#sessions) page in Pomerium Enterprise. - A user can see their session ID by navigating to the special `/.pomerium` URL endpoint from any Pomerium managed route. The unique ID is listed as "sub" under User Claims: + A user can see their session ID by navigating to the special `/.pomerium` URL endpoint from any Pomerium managed route. The unique ID is listed as "Sub" under User Details: - ![The Session Details page, showing the "sub" data](./img/session-details.png) + ![The User Details page, showing the "sub" data](./img/session-details.png) ## Service Accounts diff --git a/docs/enterprise/console-settings.yaml b/docs/enterprise/console-settings.yaml index a45ad3e45..6d682ce1d 100644 --- a/docs/enterprise/console-settings.yaml +++ b/docs/enterprise/console-settings.yaml @@ -250,12 +250,12 @@ settings: doc: | Set max connection age for GRPC servers. After this interval, servers ask clients to reconnect and perform any rediscovery for new/updated endpoints from DNS. - See https://godoc.org/google.golang.org/grpc/keepalive#ServerParameters for details + See (opens new window) for details - name: "GRPC Server Max Connection Age Grace" doc: | Additive period with grpc_server_max_connection_age, after which servers will force connections to close. - See https://godoc.org/google.golang.org/grpc/keepalive#ServerParameters (opens new window)for details + See (opens new window) for details - name: "Tracing" doc: | Tracing tracks the progression of a single user request as it is handled by Pomerium. @@ -288,28 +288,15 @@ settings: 1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button: - ![An empty Service Accounts page](./img/add-service-account.png) + ![The Service Accounts page](./img/console-service-account.png) 1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP. - ::::: tabs - :::: tab Unique - Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date: + Give the user a unique ID, or select an existing user to impersonate. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date: ![Adding a unique service account](./img/create-service-account.png) The user ID set here corresponds to the `User` criteria when editing a policy. - :::: - :::: tab Impersonated - You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out): - - ![Session Details](./img/user-id.png) - - Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date: - - ![Adding an impersonated service account](./img/create-impersonated-service-account.png) - :::: - ::::: 1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again: @@ -319,7 +306,11 @@ settings: 1. Edit or create policies to give the service account access to the internal service: - ![An example policy for a service account](./img/service-account-policy.png) + ![An example policy for a service account](./img/create-policy-1.png) + + --- + + ![An example policy for a service account](./img/create-policy-2.png) - name: "Namespaces" keys: ["namespace"] doc: | diff --git a/docs/enterprise/img/console-overview.gif b/docs/enterprise/img/console-overview.gif index 15b872748..7d1a5ff69 100644 Binary files a/docs/enterprise/img/console-overview.gif and b/docs/enterprise/img/console-overview.gif differ diff --git a/docs/enterprise/img/console-route-traffic.png b/docs/enterprise/img/console-route-traffic.png index 2e1ef189b..259c48ed0 100644 Binary files a/docs/enterprise/img/console-route-traffic.png and b/docs/enterprise/img/console-route-traffic.png differ diff --git a/docs/enterprise/img/console-service-account.png b/docs/enterprise/img/console-service-account.png new file mode 100644 index 000000000..b78fb4656 Binary files /dev/null and b/docs/enterprise/img/console-service-account.png differ diff --git a/docs/enterprise/img/console-session-landing.png b/docs/enterprise/img/console-session-landing.png deleted file mode 100644 index c6d60b4f7..000000000 Binary files a/docs/enterprise/img/console-session-landing.png and /dev/null differ diff --git a/docs/enterprise/img/console-session-list.png b/docs/enterprise/img/console-session-list.png index 76d95944e..c45617bb5 100644 Binary files a/docs/enterprise/img/console-session-list.png and b/docs/enterprise/img/console-session-list.png differ diff --git a/docs/enterprise/img/session-details.png b/docs/enterprise/img/session-details.png index db17149e4..47648f81a 100644 Binary files a/docs/enterprise/img/session-details.png and b/docs/enterprise/img/session-details.png differ diff --git a/docs/enterprise/install/helm.md b/docs/enterprise/install/helm.md index b46e21ada..b31ad5536 100644 --- a/docs/enterprise/install/helm.md +++ b/docs/enterprise/install/helm.md @@ -147,9 +147,9 @@ This setup assumes an existing certificate solution using cert-manager, as descr sudo -E kubectl --namespace pomerium port-forward service/pomerium-proxy 443:443 ``` -1. When visiting `https://console.localhost.pomerium.io`, you should see the Session List page: +1. When visiting `https://console.localhost.pomerium.io`, you should see the Traffic: - ![The Session List page after installing Pomerium Enterprise](../img/console-session-landing.png) + ![The Traffic List page after installing Pomerium Enterprise](../img/console-route-traffic.png) ## Troubleshooting diff --git a/docs/enterprise/reference/configure.md b/docs/enterprise/reference/configure.md index 284d58306..a0be18723 100644 --- a/docs/enterprise/reference/configure.md +++ b/docs/enterprise/reference/configure.md @@ -101,14 +101,14 @@ Timeouts set the global server timeouts. Timeouts can also be set for individual Set max connection age for GRPC servers. After this interval, servers ask clients to reconnect and perform any rediscovery for new/updated endpoints from DNS. -See https://godoc.org/google.golang.org/grpc/keepalive#ServerParameters for details +See (opens new window) for details #### GRPC Server Max Connection Age Grace Additive period with grpc_server_max_connection_age, after which servers will force connections to close. -See https://godoc.org/google.golang.org/grpc/keepalive#ServerParameters (opens new window)for details +See (opens new window) for details ### Tracing @@ -184,28 +184,15 @@ Before you begin, confirm you are in the correct Namespace. A service account ca 1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button: - ![An empty Service Accounts page](./img/add-service-account.png) + ![The Service Accounts page](./img/console-service-account.png) 1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP. - ::::: tabs - :::: tab Unique - Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date: + Give the user a unique ID, or select an existing user to impersonate. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date: ![Adding a unique service account](./img/create-service-account.png) The user ID set here corresponds to the `User` criteria when editing a policy. - :::: - :::: tab Impersonated - You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out): - - ![Session Details](./img/user-id.png) - - Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date: - - ![Adding an impersonated service account](./img/create-impersonated-service-account.png) - :::: - ::::: 1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again: @@ -215,7 +202,11 @@ Before you begin, confirm you are in the correct Namespace. A service account ca 1. Edit or create policies to give the service account access to the internal service: - ![An example policy for a service account](./img/service-account-policy.png) + ![An example policy for a service account](./img/create-policy-1.png) + + --- + + ![An example policy for a service account](./img/create-policy-2.png) ## Namespaces diff --git a/docs/reference/img/add-service-account.png b/docs/reference/img/add-service-account.png deleted file mode 100644 index d60147928..000000000 Binary files a/docs/reference/img/add-service-account.png and /dev/null differ diff --git a/docs/reference/img/console-service-account.png b/docs/reference/img/console-service-account.png new file mode 100644 index 000000000..b78fb4656 Binary files /dev/null and b/docs/reference/img/console-service-account.png differ diff --git a/docs/reference/img/create-impersonated-service-account.png b/docs/reference/img/create-impersonated-service-account.png deleted file mode 100644 index 6f2171efa..000000000 Binary files a/docs/reference/img/create-impersonated-service-account.png and /dev/null differ diff --git a/docs/reference/img/create-policy-1.png b/docs/reference/img/create-policy-1.png new file mode 100644 index 000000000..62138b390 Binary files /dev/null and b/docs/reference/img/create-policy-1.png differ diff --git a/docs/reference/img/create-policy-2.png b/docs/reference/img/create-policy-2.png new file mode 100644 index 000000000..32f9c221f Binary files /dev/null and b/docs/reference/img/create-policy-2.png differ diff --git a/docs/reference/img/create-service-account.png b/docs/reference/img/create-service-account.png index 44a275294..2d5505b7e 100644 Binary files a/docs/reference/img/create-service-account.png and b/docs/reference/img/create-service-account.png differ diff --git a/docs/reference/img/runtime-fullpage.png b/docs/reference/img/runtime-fullpage.png index 734d58588..3875bc264 100644 Binary files a/docs/reference/img/runtime-fullpage.png and b/docs/reference/img/runtime-fullpage.png differ diff --git a/docs/reference/img/service-account-jwt.png b/docs/reference/img/service-account-jwt.png index eb9010701..7aa664734 100644 Binary files a/docs/reference/img/service-account-jwt.png and b/docs/reference/img/service-account-jwt.png differ diff --git a/docs/reference/img/service-account-policy.png b/docs/reference/img/service-account-policy.png deleted file mode 100644 index 96b113862..000000000 Binary files a/docs/reference/img/service-account-policy.png and /dev/null differ diff --git a/docs/reference/img/sessions-fullpage.png b/docs/reference/img/sessions-fullpage.png index 1cddc0ebe..efd1288f4 100644 Binary files a/docs/reference/img/sessions-fullpage.png and b/docs/reference/img/sessions-fullpage.png differ diff --git a/docs/reference/img/traffic-fullpage.png b/docs/reference/img/traffic-fullpage.png index aabcb780e..da26dcbd7 100644 Binary files a/docs/reference/img/traffic-fullpage.png and b/docs/reference/img/traffic-fullpage.png differ