From 0fc5db1c474e5a39cbe639c56324b2e6a1530514 Mon Sep 17 00:00:00 2001 From: Milvus-doc-bot Date: Fri, 6 Dec 2024 02:27:01 +0000 Subject: [PATCH] Generate en docs --- .../site/en/adminGuide/connect_kafka_ssl.json | 2 +- .../site/en/adminGuide/connect_kafka_ssl.md | 14 +- .../v2.5.x/site/en/adminGuide/tls.json | 2 +- localization/v2.5.x/site/en/adminGuide/tls.md | 693 +++++++----------- .../install_standalone-docker-compose.json | 2 +- .../install_standalone-docker-compose.md | 4 +- .../install_standalone-windows.json | 2 +- .../install_standalone-windows.md | 4 +- .../en/integrations/dify_with_milvus.json | 2 +- .../site/en/integrations/dify_with_milvus.md | 2 +- .../integrations/integrate_with_fastgpt.json | 2 +- .../en/integrations/integrate_with_fastgpt.md | 4 +- .../knowledge_table_with_milvus.json | 2 +- .../knowledge_table_with_milvus.md | 4 +- .../integrations/use_milvus_in_docsgpt.json | 2 +- .../en/integrations/use_milvus_in_docsgpt.md | 2 +- .../tools/milvus-cdc/deploy-cdc-server.json | 2 +- .../tools/milvus-cdc/deploy-cdc-server.md | 2 +- 18 files changed, 296 insertions(+), 451 deletions(-) diff --git a/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.json b/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.json index 1fb47aa93..cd5252c91 100644 --- a/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.json +++ b/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.json @@ -1 +1 @@ -{"codeList":["version: '3'\nservices:\n zookeeper:\n image: wurstmeister/zookeeper:latest\n container_name: zookeeper\n ports:\n - 2181:2181\n restart: always\n\n kafka:\n image: wurstmeister/kafka:latest\n container_name: kafka\n ports:\n - 9092:9092\n environment:\n - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181\n - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://localhost:9092\n - KAFKA_LISTENERS=PLAINTEXT://:9092\n volumes:\n - /var/run/docker.sock:/var/run/docker.sock\n restart: always\n","$ docker-compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9092\"\n saslUsername:\n saslPassword:\n saslMechanisms:\n securityProtocol:\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: false # Whether to support kafka secure connection mode\n tlsCert: \n tlsKey:\n tlsCACert:\n tlsKeyPassword:\n","$ docker-compose up -d\n","version: '3'\nservices:\n zookeeper:\n image: confluentinc/cp-zookeeper:latest\n container_name: zookeeper\n environment:\n ZOOKEEPER_CLIENT_PORT: 2181\n ZOOKEEPER_TICK_TIME: 2000\n ports:\n - 2181:2181\n\n kafka:\n image: confluentinc/cp-kafka:latest\n container_name: kafka\n depends_on:\n - zookeeper\n ports:\n - 9092:9092\n - 9093:9093\n environment:\n KAFKA_BROKER_ID: 1\n KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'\n ZOOKEEPER_SASL_ENABLED: \"false\"\n KAFKA_ADVERTISED_LISTENERS: SASL_PLAINTEXT://localhost:9093\n KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SASL_PLAINTEXT:SASL_PLAINTEXT\n KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SASL_PLAINTEXT\n KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN\n KAFKA_SASL_ENABLED_MECHANISMS: PLAIN\n KAFKA_CONFLUENT_TOPIC_REPLICATION_FACTOR: 1\n KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1\n KAFKA_DEFAULT_REPLICATION_FACTOR: 1\n KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1\n KAFKA_OPTS: \"-Djava.security.auth.login.config=/etc/kafka/configs/kafka_server_jass.conf\"\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/kafka_server_jass.conf:/etc/kafka/configs/kafka_server_jass.conf\n","KafkaServer {\n org.apache.kafka.common.security.plain.PlainLoginModule required\n username=\"kafka\"\n password=\"pass123\"\n user_kafka=\"pass123\";\n};\n","$ docker-compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9093\"\n saslUsername: kafka\n saslPassword: pass123\n saslMechanisms: PLAIN\n securityProtocol: SASL_PLAINTEXT\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: false # Whether to support kafka secure connection mode\n tlsCert: # path to client's public key\n tlsKey: # path to client's private key\n tlsCACert: # file or directory path to CA certificate\n tlsKeyPassword: # private key passphrase for use with private key, if any\n","$ docker-compose up -d\n","#!/bin/bash\n#\n#\n# This scripts generates:\n# - root CA certificate\n# - server certificate and keystore\n# - client keys\n#\n# https://cwiki.apache.org/confluence/display/KAFKA/Deploying+SSL+for+Kafka\n#\n\n\nif [[ \"$1\" == \"-k\" ]]; then\n USE_KEYTOOL=1\n shift\nelse\n USE_KEYTOOL=0\nfi\n\nOP=\"$1\"\nCA_CERT=\"$2\"\nPFX=\"$3\"\nHOST=\"$4\"\n\nC=NN\nST=NN\nL=NN\nO=NN\nOU=NN\nCN=\"kafka-ssl\"\n \n\n# Password\nPASS=\"abcdefgh\"\n\n# Cert validity, in days\nVALIDITY=365\n\nset -e\n\nexport LC_ALL=C\n\nif [[ $OP == \"ca\" && ! -z \"$CA_CERT\" && ! -z \"$3\" ]]; then\n CN=\"$3\"\n openssl req -new -x509 -keyout ${CA_CERT}.key -out $CA_CERT -days $VALIDITY -passin \"pass:$PASS\" -passout \"pass:$PASS\" < \"\n echo \" $0 [-k] server|client \"\n echo \"\"\n echo \" -k = Use keytool/Java Keystore, else standard SSL keys\"\n exit 1\nfi\n","$ ./gen-ssl-certs.sh ca ca-cert kafka-ssl\n","$ ./gen-ssl-certs.sh -k server ca-cert kafka_ kafka-ssl\n","$ ./gen-ssl-certs.sh client ca-cert kafka_ kafka-client\n","$ ls -l my_secrets\ntotal 12\n-rw-rw-r-- 1 1.4K Feb 26 11:53 ca-cert\n-rw------- 1 1.9K Feb 26 11:53 ca-cert.key\n-rw-rw-r-- 1 41 Feb 26 11:54 ca-cert.srl\n-rw-rw-r-- 1 9 Feb 26 12:08 cert_creds\n-rwxrwxr-x 1 3.9K Feb 26 17:26 gen-ssl-certs.sh\n-rw-rw-r-- 1 1.4K Feb 26 11:54 kafka_cert-file\n-rw-rw-r-- 1 1.4K Feb 26 11:54 kafka_cert-signed\n-rw------- 1 1.8K Feb 26 11:54 kafka_client.key\n-rw-rw-r-- 1 1.2K Feb 26 11:54 kafka_client.pem\n-rw-rw-r-- 1 1013 Feb 26 11:54 kafka_client.req\n-rw-rw-r-- 1 5.6K Feb 26 11:54 kafka_server.keystore.jks\n-rw-rw-r-- 1 1.4K Feb 26 11:54 kafka_server.truststore.jks\n","version: '3'\nservices:\n zookeeper:\n image: confluentinc/cp-zookeeper:latest\n container_name: zookeeper\n hostname: zookeeper\n ports:\n - 2181:2181\n environment:\n ZOOKEEPER_SERVER_ID: 1\n ZOOKEEPER_CLIENT_PORT: 2181\n\n kafka-ssl:\n image: confluentinc/cp-kafka:latest\n container_name: kafka-ssl\n hostname: kafka-ssl\n ports:\n - 9093:9093\n depends_on:\n - zookeeper\n environment:\n KAFKA_BROKER_ID: 1\n KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'\n ZOOKEEPER_SASL_ENABLED: \"false\"\n KAFKA_ADVERTISED_LISTENERS: SSL://kafka-ssl:9093\n KAFKA_SSL_KEYSTORE_FILENAME: kafka_server.keystore.jks\n KAFKA_SSL_KEYSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_KEY_CREDENTIALS: cert_creds\n KAFKA_SSL_TRUSTSTORE_FILENAME: kafka_server.truststore.jks\n KAFKA_SSL_TRUSTSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_CLIENT_AUTH: 'required'\n KAFKA_SECURITY_PROTOCOL: SSL\n KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SSL\n KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1\n\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/etc/kafka/secrets\n","$ docker-compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/milvus/secrets\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9093\"\n saslUsername: \n saslPassword: \n saslMechanisms: \n securityProtocol: SSL\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: true # Whether to support kafka secure connection mode\n tlsCert: /milvus/secrets/kafka_client.pem # path to client's public key\n tlsKey: /milvus/secrets/kafka_client.key # path to client's private key\n tlsCACert: /milvus/secrets/ca-cert # file or directory path to CA certificate\n tlsKeyPassword: abcdefgh # private key passphrase for use with private key, if any\n","$ docker-compose up -d\n","version: '3'\nservices:\n zookeeper:\n image: confluentinc/cp-zookeeper:latest\n container_name: zookeeper\n hostname: zookeeper\n ports:\n - 2181:2181\n environment:\n ZOOKEEPER_SERVER_ID: 1\n ZOOKEEPER_CLIENT_PORT: 2181\n ZOOKEEPER_TICK_TIME: 2000\n\n\n kafka-ssl:\n image: confluentinc/cp-kafka:latest\n container_name: kafka-ssl\n hostname: kafka-ssl\n ports:\n - 9093:9093\n depends_on:\n - zookeeper\n environment:\n KAFKA_BROKER_ID: 1\n KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'\n ZOOKEEPER_SASL_ENABLED: \"false\"\n KAFKA_ADVERTISED_LISTENERS: SASL_SSL://kafka-ssl:9093\n KAFKA_SSL_KEYSTORE_FILENAME: kafka_server.keystore.jks\n KAFKA_SSL_KEYSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_KEY_CREDENTIALS: cert_creds\n KAFKA_SSL_TRUSTSTORE_FILENAME: kafka_server.truststore.jks\n KAFKA_SSL_TRUSTSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_CLIENT_AUTH: 'required'\n KAFKA_SECURITY_PROTOCOL: SASL_SSL\n KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1\n\n KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SASL_SSL:SASL_SSL\n KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SASL_SSL\n KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN\n KAFKA_SASL_ENABLED_MECHANISMS: PLAIN\n KAFKA_CONFLUENT_TOPIC_REPLICATION_FACTOR: 1\n KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1\n KAFKA_DEFAULT_REPLICATION_FACTOR: 1\n KAFKA_OPTS: \"-Djava.security.auth.login.config=/etc/kafka/configs/kafka_server_jass.conf\"\n\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/etc/kafka/secrets\n - ${DOCKER_VOLUME_DIRECTORY:-.}/kafka_server_jass.conf:/etc/kafka/configs/kafka_server_jass.conf\n","$ docker-compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/milvus/secrets\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9093\"\n saslUsername: kafka\n saslPassword: pass123\n saslMechanisms: PLAIN\n securityProtocol: SASL_SSL\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: true # Whether to support kafka secure connection mode\n tlsCert: /milvus/secrets/kafka_client.pem # path to client's public key\n tlsKey: /milvus/secrets/kafka_client.key # path to client's private key\n tlsCACert: /milvus/secrets/ca-cert # file or directory path to CA certificate\n tlsKeyPassword: abcdefgh # private key passphrase for use with private key, if any\n"],"headingContent":"Connecting to Kafka with SASL/SSL","anchorList":[{"label":"Connecting to Kafka with SASL/SSL","href":"Connecting-to-Kafka-with-SASLSSL","type":1,"isActive":false},{"label":"Connect Milvus to Kafka Without SASL/SSL","href":"Connect-Milvus-to-Kafka-Without-SASLSSL","type":2,"isActive":false},{"label":"Connect Milus to Kafka with SASL/PLAIN Alone","href":"Connect-Milus-to-Kafka-with-SASLPLAIN-Alone","type":2,"isActive":false},{"label":"Connect Milvus to Kafka with SSL Alone","href":"Connect-Milvus-to-Kafka-with-SSL-Alone","type":2,"isActive":false},{"label":"Connect Milvus to Kafka with SASL/PLAIN and SSL","href":"Connect-Milvus-to-Kafka-with-SASLPLAIN-and-SSL","type":2,"isActive":false}]} \ No newline at end of file +{"codeList":["version: '3'\nservices:\n zookeeper:\n image: wurstmeister/zookeeper:latest\n container_name: zookeeper\n ports:\n - 2181:2181\n restart: always\n\n kafka:\n image: wurstmeister/kafka:latest\n container_name: kafka\n ports:\n - 9092:9092\n environment:\n - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181\n - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://localhost:9092\n - KAFKA_LISTENERS=PLAINTEXT://:9092\n volumes:\n - /var/run/docker.sock:/var/run/docker.sock\n restart: always\n","$ docker compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9092\"\n saslUsername:\n saslPassword:\n saslMechanisms:\n securityProtocol:\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: false # Whether to support kafka secure connection mode\n tlsCert: \n tlsKey:\n tlsCACert:\n tlsKeyPassword:\n","$ docker compose up -d\n","version: '3'\nservices:\n zookeeper:\n image: confluentinc/cp-zookeeper:latest\n container_name: zookeeper\n environment:\n ZOOKEEPER_CLIENT_PORT: 2181\n ZOOKEEPER_TICK_TIME: 2000\n ports:\n - 2181:2181\n\n kafka:\n image: confluentinc/cp-kafka:latest\n container_name: kafka\n depends_on:\n - zookeeper\n ports:\n - 9092:9092\n - 9093:9093\n environment:\n KAFKA_BROKER_ID: 1\n KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'\n ZOOKEEPER_SASL_ENABLED: \"false\"\n KAFKA_ADVERTISED_LISTENERS: SASL_PLAINTEXT://localhost:9093\n KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SASL_PLAINTEXT:SASL_PLAINTEXT\n KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SASL_PLAINTEXT\n KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN\n KAFKA_SASL_ENABLED_MECHANISMS: PLAIN\n KAFKA_CONFLUENT_TOPIC_REPLICATION_FACTOR: 1\n KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1\n KAFKA_DEFAULT_REPLICATION_FACTOR: 1\n KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1\n KAFKA_OPTS: \"-Djava.security.auth.login.config=/etc/kafka/configs/kafka_server_jass.conf\"\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/kafka_server_jass.conf:/etc/kafka/configs/kafka_server_jass.conf\n","KafkaServer {\n org.apache.kafka.common.security.plain.PlainLoginModule required\n username=\"kafka\"\n password=\"pass123\"\n user_kafka=\"pass123\";\n};\n","$ docker compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9093\"\n saslUsername: kafka\n saslPassword: pass123\n saslMechanisms: PLAIN\n securityProtocol: SASL_PLAINTEXT\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: false # Whether to support kafka secure connection mode\n tlsCert: # path to client's public key\n tlsKey: # path to client's private key\n tlsCACert: # file or directory path to CA certificate\n tlsKeyPassword: # private key passphrase for use with private key, if any\n","$ docker compose up -d\n","#!/bin/bash\n#\n#\n# This scripts generates:\n# - root CA certificate\n# - server certificate and keystore\n# - client keys\n#\n# https://cwiki.apache.org/confluence/display/KAFKA/Deploying+SSL+for+Kafka\n#\n\n\nif [[ \"$1\" == \"-k\" ]]; then\n USE_KEYTOOL=1\n shift\nelse\n USE_KEYTOOL=0\nfi\n\nOP=\"$1\"\nCA_CERT=\"$2\"\nPFX=\"$3\"\nHOST=\"$4\"\n\nC=NN\nST=NN\nL=NN\nO=NN\nOU=NN\nCN=\"kafka-ssl\"\n \n\n# Password\nPASS=\"abcdefgh\"\n\n# Cert validity, in days\nVALIDITY=365\n\nset -e\n\nexport LC_ALL=C\n\nif [[ $OP == \"ca\" && ! -z \"$CA_CERT\" && ! -z \"$3\" ]]; then\n CN=\"$3\"\n openssl req -new -x509 -keyout ${CA_CERT}.key -out $CA_CERT -days $VALIDITY -passin \"pass:$PASS\" -passout \"pass:$PASS\" < \"\n echo \" $0 [-k] server|client \"\n echo \"\"\n echo \" -k = Use keytool/Java Keystore, else standard SSL keys\"\n exit 1\nfi\n","$ ./gen-ssl-certs.sh ca ca-cert kafka-ssl\n","$ ./gen-ssl-certs.sh -k server ca-cert kafka_ kafka-ssl\n","$ ./gen-ssl-certs.sh client ca-cert kafka_ kafka-client\n","$ ls -l my_secrets\ntotal 12\n-rw-rw-r-- 1 1.4K Feb 26 11:53 ca-cert\n-rw------- 1 1.9K Feb 26 11:53 ca-cert.key\n-rw-rw-r-- 1 41 Feb 26 11:54 ca-cert.srl\n-rw-rw-r-- 1 9 Feb 26 12:08 cert_creds\n-rwxrwxr-x 1 3.9K Feb 26 17:26 gen-ssl-certs.sh\n-rw-rw-r-- 1 1.4K Feb 26 11:54 kafka_cert-file\n-rw-rw-r-- 1 1.4K Feb 26 11:54 kafka_cert-signed\n-rw------- 1 1.8K Feb 26 11:54 kafka_client.key\n-rw-rw-r-- 1 1.2K Feb 26 11:54 kafka_client.pem\n-rw-rw-r-- 1 1013 Feb 26 11:54 kafka_client.req\n-rw-rw-r-- 1 5.6K Feb 26 11:54 kafka_server.keystore.jks\n-rw-rw-r-- 1 1.4K Feb 26 11:54 kafka_server.truststore.jks\n","version: '3'\nservices:\n zookeeper:\n image: confluentinc/cp-zookeeper:latest\n container_name: zookeeper\n hostname: zookeeper\n ports:\n - 2181:2181\n environment:\n ZOOKEEPER_SERVER_ID: 1\n ZOOKEEPER_CLIENT_PORT: 2181\n\n kafka-ssl:\n image: confluentinc/cp-kafka:latest\n container_name: kafka-ssl\n hostname: kafka-ssl\n ports:\n - 9093:9093\n depends_on:\n - zookeeper\n environment:\n KAFKA_BROKER_ID: 1\n KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'\n ZOOKEEPER_SASL_ENABLED: \"false\"\n KAFKA_ADVERTISED_LISTENERS: SSL://kafka-ssl:9093\n KAFKA_SSL_KEYSTORE_FILENAME: kafka_server.keystore.jks\n KAFKA_SSL_KEYSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_KEY_CREDENTIALS: cert_creds\n KAFKA_SSL_TRUSTSTORE_FILENAME: kafka_server.truststore.jks\n KAFKA_SSL_TRUSTSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_CLIENT_AUTH: 'required'\n KAFKA_SECURITY_PROTOCOL: SSL\n KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SSL\n KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1\n\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/etc/kafka/secrets\n","$ docker compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/milvus/secrets\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9093\"\n saslUsername: \n saslPassword: \n saslMechanisms: \n securityProtocol: SSL\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: true # Whether to support kafka secure connection mode\n tlsCert: /milvus/secrets/kafka_client.pem # path to client's public key\n tlsKey: /milvus/secrets/kafka_client.key # path to client's private key\n tlsCACert: /milvus/secrets/ca-cert # file or directory path to CA certificate\n tlsKeyPassword: abcdefgh # private key passphrase for use with private key, if any\n","$ docker compose up -d\n","version: '3'\nservices:\n zookeeper:\n image: confluentinc/cp-zookeeper:latest\n container_name: zookeeper\n hostname: zookeeper\n ports:\n - 2181:2181\n environment:\n ZOOKEEPER_SERVER_ID: 1\n ZOOKEEPER_CLIENT_PORT: 2181\n ZOOKEEPER_TICK_TIME: 2000\n\n\n kafka-ssl:\n image: confluentinc/cp-kafka:latest\n container_name: kafka-ssl\n hostname: kafka-ssl\n ports:\n - 9093:9093\n depends_on:\n - zookeeper\n environment:\n KAFKA_BROKER_ID: 1\n KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'\n ZOOKEEPER_SASL_ENABLED: \"false\"\n KAFKA_ADVERTISED_LISTENERS: SASL_SSL://kafka-ssl:9093\n KAFKA_SSL_KEYSTORE_FILENAME: kafka_server.keystore.jks\n KAFKA_SSL_KEYSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_KEY_CREDENTIALS: cert_creds\n KAFKA_SSL_TRUSTSTORE_FILENAME: kafka_server.truststore.jks\n KAFKA_SSL_TRUSTSTORE_CREDENTIALS: cert_creds\n KAFKA_SSL_CLIENT_AUTH: 'required'\n KAFKA_SECURITY_PROTOCOL: SASL_SSL\n KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1\n\n KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SASL_SSL:SASL_SSL\n KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SASL_SSL\n KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN\n KAFKA_SASL_ENABLED_MECHANISMS: PLAIN\n KAFKA_CONFLUENT_TOPIC_REPLICATION_FACTOR: 1\n KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1\n KAFKA_DEFAULT_REPLICATION_FACTOR: 1\n KAFKA_OPTS: \"-Djava.security.auth.login.config=/etc/kafka/configs/kafka_server_jass.conf\"\n\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/etc/kafka/secrets\n - ${DOCKER_VOLUME_DIRECTORY:-.}/kafka_server_jass.conf:/etc/kafka/configs/kafka_server_jass.conf\n","$ docker compose up -d\n","version: '3.5'\n\nservices:\n etcd:\n ......\n \n minio:\n ......\n \n standalone:\n container_name: milvus-standalone\n ......\n volumes:\n - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n - ${DOCKER_VOLUME_DIRECTORY:-.}/my_secrets:/milvus/secrets\n","$ wget https://raw.githubusercontent.com/zilliztech/milvus-operator/main/config/samples/milvus_cluster_default.yaml -O milvus.yaml\n","mq:\n type: kafka\n\nkafka:\n brokerList: \"127.0.0.1:9093\"\n saslUsername: kafka\n saslPassword: pass123\n saslMechanisms: PLAIN\n securityProtocol: SASL_SSL\n readTimeout: 10 # read message timeout in seconds\n ssl:\n enabled: true # Whether to support kafka secure connection mode\n tlsCert: /milvus/secrets/kafka_client.pem # path to client's public key\n tlsKey: /milvus/secrets/kafka_client.key # path to client's private key\n tlsCACert: /milvus/secrets/ca-cert # file or directory path to CA certificate\n tlsKeyPassword: abcdefgh # private key passphrase for use with private key, if any\n"],"headingContent":"Connecting to Kafka with SASL/SSL","anchorList":[{"label":"Connecting to Kafka with SASL/SSL","href":"Connecting-to-Kafka-with-SASLSSL","type":1,"isActive":false},{"label":"Connect Milvus to Kafka Without SASL/SSL","href":"Connect-Milvus-to-Kafka-Without-SASLSSL","type":2,"isActive":false},{"label":"Connect Milus to Kafka with SASL/PLAIN Alone","href":"Connect-Milus-to-Kafka-with-SASLPLAIN-Alone","type":2,"isActive":false},{"label":"Connect Milvus to Kafka with SSL Alone","href":"Connect-Milvus-to-Kafka-with-SSL-Alone","type":2,"isActive":false},{"label":"Connect Milvus to Kafka with SASL/PLAIN and SSL","href":"Connect-Milvus-to-Kafka-with-SASLPLAIN-and-SSL","type":2,"isActive":false}]} \ No newline at end of file diff --git a/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.md b/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.md index 0883ffa20..fae0c67a7 100644 --- a/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.md +++ b/localization/v2.5.x/site/en/adminGuide/connect_kafka_ssl.md @@ -62,7 +62,7 @@ services: restart: always

Then you can start the Kafka service with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
2. Start Milvus and Connect to Kafka
Once the Kafka service is started, you can start Milvus and connect to it. Use the following docker-compose.yaml file to start Milvus and connect to Kafka without SASL/SSL:

 
version: '3.5'
@@ -103,7 +103,7 @@ kafka:
     tlsKeyPassword:
 

 
Then you can start Milvus with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
Connect Milus to Kafka with SASL/PLAIN Alone

 
Then you can start the Kafka service with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
2. Start Milvus and Connect to Kafka
Once the Kafka service is started, you can start Milvus and connect to it. Use the following docker-compose.yaml file to start Milvus and connect to Kafka with SASL/PLAIN:

 
version: '3.5'
@@ -208,7 +208,7 @@ kafka:
     tlsKeyPassword: # private key passphrase for use with private key, if any
 

 
Then you can start Milvus with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
Connect Milvus to Kafka with SSL Alone

 
Then start the Kafka service with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
3. Start Milvus and Connect to Kafka with SSL
Once the Kafka service is started, you can start Milvus and connect to it. Use the following docker-compose.yaml file to start Milvus and connect to Kafka with SSL:

 
version: '3.5'
@@ -506,7 +506,7 @@ kafka:
     tlsKeyPassword: abcdefgh # private key passphrase for use with private key, if any
 

 
Then start Milvus with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
Connect Milvus to Kafka with SASL/PLAIN and SSL

 
Then start the Kafka service with the following command:

-
$ docker-compose up -d
+
$ docker compose up -d
 

 
2. Start Milvus and Connect to Kafka with SASL/PLAIN and SSL
Once the Kafka service is started, you can start Milvus and connect to it. Use the following docker-compose.yaml file to start Milvus and connect to Kafka with SASL/PLAIN and SSL:

 
version: '3.5'
diff --git a/localization/v2.5.x/site/en/adminGuide/tls.json b/localization/v2.5.x/site/en/adminGuide/tls.json
index be4777934..af49b3f8f 100644
--- a/localization/v2.5.x/site/en/adminGuide/tls.json
+++ b/localization/v2.5.x/site/en/adminGuide/tls.json
@@ -1 +1 @@
-{"codeList":["openssl version\n","sudo apt install openssl\n","mkdir cert && cd cert\ntouch openssl.cnf gen.sh\n","#\n# OpenSSL example configuration file.\n# This is mostly being used for generation of certificate requests.\n#\n\n# This definition stops the following lines choking if HOME isn't\n# defined.\nHOME            = .\nRANDFILE        = $ENV::HOME/.rnd\n\n# Extra OBJECT IDENTIFIER info:\n#oid_file       = $ENV::HOME/.oid\noid_section     = new_oids\n\n# To use this configuration file with the \"-extfile\" option of the\n# \"openssl x509\" utility, name here the section containing the\n# X.509v3 extensions to use:\n# extensions        = \n# (Alternatively, use a configuration file that has only\n# X.509v3 extensions in its main [= default] section.)\n\n[ new_oids ]\n\n# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.\n# Add a simple OID like this:\n# testoid1=1.2.3.4\n# Or use config file substitution like this:\n# testoid2=${testoid1}.5.6\n\n# Policies used by the TSA examples.\ntsa_policy1 = 1.2.3.4.1\ntsa_policy2 = 1.2.3.4.5.6\ntsa_policy3 = 1.2.3.4.5.7\n\n####################################################################\n[ ca ]\ndefault_ca  = CA_default        # The default ca section\n\n####################################################################\n[ CA_default ]\n\ndir     = ./demoCA      # Where everything is kept\ncerts       = $dir/certs        # Where the issued certs are kept\ncrl_dir     = $dir/crl      # Where the issued crl are kept\ndatabase    = $dir/index.txt    # database index file.\n#unique_subject = no            # Set to 'no' to allow creation of\n                    # several ctificates with same subject.\nnew_certs_dir   = $dir/newcerts     # default place for new certs.\n\ncertificate = $dir/cacert.pem   # The CA certificate\nserial      = $dir/serial       # The current serial number\ncrlnumber   = $dir/crlnumber    # the current crl number\n                    # must be commented out to leave a V1 CRL\ncrl     = $dir/crl.pem      # The current CRL\nprivate_key = $dir/private/cakey.pem# The private key\nRANDFILE    = $dir/private/.rand    # private random number file\n\nx509_extensions = usr_cert      # The extentions to add to the cert\n\n# Comment out the following two lines for the \"traditional\"\n# (and highly broken) format.\nname_opt    = ca_default        # Subject Name options\ncert_opt    = ca_default        # Certificate field options\n\n# Extension copying option: use with caution.\ncopy_extensions = copy\n\n# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs\n# so this is commented out by default to leave a V1 CRL.\n# crlnumber must also be commented out to leave a V1 CRL.\n# crl_extensions    = crl_ext\n\ndefault_days    = 365           # how long to certify for\ndefault_crl_days= 30            # how long before next CRL\ndefault_md  = default       # use public key default MD\npreserve    = no            # keep passed DN ordering\n\n# A few difference way of specifying how similar the request should look\n# For type CA, the listed attributes must be the same, and the optional\n# and supplied fields are just that :-)\npolicy      = policy_match\n\n# For the CA policy\n[ policy_match ]\ncountryName     = match\nstateOrProvinceName = match\norganizationName    = match\norganizationalUnitName  = optional\ncommonName      = supplied\nemailAddress        = optional\n\n# For the 'anything' policy\n# At this point in time, you must list all acceptable 'object'\n# types.\n[ policy_anything ]\ncountryName     = optional\nstateOrProvinceName = optional\nlocalityName        = optional\norganizationName    = optional\norganizationalUnitName  = optional\ncommonName      = supplied\nemailAddress        = optional\n\n####################################################################\n[ req ]\ndefault_bits        = 2048\ndefault_keyfile     = privkey.pem\ndistinguished_name  = req_distinguished_name\nattributes      = req_attributes\nx509_extensions = v3_ca # The extentions to add to the self signed cert\n\n# Passwords for private keys if not present they will be prompted for\n# input_password = secret\n# output_password = secret\n\n# This sets a mask for permitted string types. There are several options. \n# default: PrintableString, T61String, BMPString.\n# pkix   : PrintableString, BMPString (PKIX recommendation before 2004)\n# utf8only: only UTF8Strings (PKIX recommendation after 2004).\n# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).\n# MASK:XXXX a literal mask value.\n# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.\nstring_mask = utf8only\n\nreq_extensions = v3_req # The extensions to add to a certificate request\n\n[ req_distinguished_name ]\ncountryName         = Country Name (2 letter code)\ncountryName_default     = AU\ncountryName_min         = 2\ncountryName_max         = 2\n\nstateOrProvinceName     = State or Province Name (full name)\nstateOrProvinceName_default = Some-State\n\nlocalityName            = Locality Name (eg, city)\n\n0.organizationName      = Organization Name (eg, company)\n0.organizationName_default  = Internet Widgits Pty Ltd\n\n# we can do this but it is not needed normally :-)\n#1.organizationName     = Second Organization Name (eg, company)\n#1.organizationName_default = World Wide Web Pty Ltd\n\norganizationalUnitName      = Organizational Unit Name (eg, section)\n#organizationalUnitName_default =\n\ncommonName          = Common Name (e.g. server FQDN or YOUR name)\ncommonName_max          = 64\n\nemailAddress            = Email Address\nemailAddress_max        = 64\n\n# SET-ex3           = SET extension number 3\n\n[ req_attributes ]\nchallengePassword       = A challenge password\nchallengePassword_min       = 4\nchallengePassword_max       = 20\n\nunstructuredName        = An optional company name\n\n[ usr_cert ]\n\n# These extensions are added when 'ca' signs a request.\n\n# This goes against PKIX guidelines but some CAs do it and some software\n# requires this to avoid interpreting an end user certificate as a CA.\n\nbasicConstraints=CA:FALSE\n\n# Here are some examples of the usage of nsCertType. If it is omitted\n# the certificate can be used for anything *except* object signing.\n\n# This is OK for an SSL server.\n# nsCertType            = server\n\n# For an object signing certificate this would be used.\n# nsCertType = objsign\n\n# For normal client use this is typical\n# nsCertType = client, email\n\n# and for everything including object signing:\n# nsCertType = client, email, objsign\n\n# This is typical in keyUsage for a client certificate.\n# keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n\n# This will be displayed in Netscape's comment listbox.\nnsComment           = \"OpenSSL Generated Certificate\"\n\n# PKIX recommendations harmless if included in all certificates.\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\n\n# This stuff is for subjectAltName and issuerAltname.\n# Import the email address.\n# subjectAltName=email:copy\n# An alternative to produce certificates that aren't\n# deprecated according to PKIX.\n# subjectAltName=email:move\n\n# Copy subject details\n# issuerAltName=issuer:copy\n\n#nsCaRevocationUrl      = http://www.domain.dom/ca-crl.pem\n#nsBaseUrl\n#nsRevocationUrl\n#nsRenewalUrl\n#nsCaPolicyUrl\n#nsSslServerName\n\n# This is required for TSA certificates.\n# extendedKeyUsage = critical,timeStamping\n\n[ v3_req ]\n\n# Extensions to add to a certificate request\n\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\n\n\n[ v3_ca ]\n\n\n# Extensions for a typical CA\n\n\n# PKIX recommendation.\n\nsubjectKeyIdentifier=hash\n\nauthorityKeyIdentifier=keyid:always,issuer\n\n# This is what PKIX recommends but some broken software chokes on critical\n# extensions.\n#basicConstraints = critical,CA:true\n# So we do this instead.\nbasicConstraints = CA:true\n\n# Key usage: this is typical for a CA certificate. However since it will\n# prevent it being used as an test self-signed certificate it is best\n# left out by default.\n# keyUsage = cRLSign, keyCertSign\n\n# Some might want this also\n# nsCertType = sslCA, emailCA\n\n# Include email address in subject alt name: another PKIX recommendation\n# subjectAltName=email:copy\n# Copy issuer details\n# issuerAltName=issuer:copy\n\n# DER hex encoding of an extension: beware experts only!\n# obj=DER:02:03\n# Where 'obj' is a standard or added object\n# You can even override a supported extension:\n# basicConstraints= critical, DER:30:03:01:01:FF\n\n[ crl_ext ]\n\n# CRL extensions.\n# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.\n\n# issuerAltName=issuer:copy\nauthorityKeyIdentifier=keyid:always\n\n[ proxy_cert_ext ]\n# These extensions should be added when creating a proxy certificate\n\n# This goes against PKIX guidelines but some CAs do it and some software\n# requires this to avoid interpreting an end user certificate as a CA.\n\nbasicConstraints=CA:FALSE\n\n# Here are some examples of the usage of nsCertType. If it is omitted\n# the certificate can be used for anything *except* object signing.\n\n# This is OK for an SSL server.\n# nsCertType            = server\n\n# For an object signing certificate this would be used.\n# nsCertType = objsign\n\n# For normal client use this is typical\n# nsCertType = client, email\n\n# and for everything including object signing:\n# nsCertType = client, email, objsign\n\n# This is typical in keyUsage for a client certificate.\n# keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n\n# This will be displayed in Netscape's comment listbox.\nnsComment           = \"OpenSSL Generated Certificate\"\n\n# PKIX recommendations harmless if included in all certificates.\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\n\n# This stuff is for subjectAltName and issuerAltname.\n# Import the email address.\n# subjectAltName=email:copy\n# An alternative to produce certificates that aren't\n# deprecated according to PKIX.\n# subjectAltName=email:move\n\n# Copy subject details\n# issuerAltName=issuer:copy\n\n#nsCaRevocationUrl      = http://www.domain.dom/ca-crl.pem\n#nsBaseUrl\n#nsRevocationUrl\n#nsRenewalUrl\n#nsCaPolicyUrl\n#nsSslServerName\n\n# This really needs to be in place for it to be a proxy certificate.\nproxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo\n\n####################################################################\n[ tsa ]\n\ndefault_tsa = tsa_config1   # the default TSA section\n\n[ tsa_config1 ]\n\n# These are used by the TSA reply generation only.\ndir     = ./demoCA      # TSA root directory\nserial      = $dir/tsaserial    # The current serial number (mandatory)\ncrypto_device   = builtin       # OpenSSL engine to use for signing\nsigner_cert = $dir/tsacert.pem  # The TSA signing certificate\n                    # (optional)\ncerts       = $dir/cacert.pem   # Certificate chain to include in reply\n                    # (optional)\nsigner_key  = $dir/private/tsakey.pem # The TSA private key (optional)\n\ndefault_policy  = tsa_policy1       # Policy if request did not specify it\n                    # (optional)\nother_policies  = tsa_policy2, tsa_policy3  # acceptable policies (optional)\ndigests     = md5, sha1     # Acceptable message digests (mandatory)\naccuracy    = secs:1, millisecs:500, microsecs:100  # (optional)\nclock_precision_digits  = 0 # number of digits after dot. (optional)\nordering        = yes   # Is ordering defined for timestamps?\n                # (optional, default: no)\ntsa_name        = yes   # Must the TSA name be included in the reply?\n                # (optional, default: no)\ness_cert_id_chain   = no    # Must the ESS cert id chain be included?\n                # (optional, default: no)\n","#!/usr/bin/env sh\n# your variables\nCountry=\"CN\"\nState=\"Shanghai\"\nLocation=\"Shanghai\"\nOrganization=\"milvus\"\nOrganizational=\"milvus\"\nCommonName=\"localhost\"\n\necho \"generate ca.key\"\nopenssl genrsa -out ca.key 2048\n\necho \"generate ca.pem\"\nopenssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$Organizational/CN=$CommonName\"\n\necho \"generate server SAN certificate\"\nopenssl genpkey -algorithm RSA -out server.key\nopenssl req -new -nodes -key server.key -out server.csr -days 3650 -subj \"/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName\" -config ./openssl.cnf -extensions v3_req\nopenssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req\n\necho \"generate client SAN certificate\"\nopenssl genpkey -algorithm RSA -out client.key\nopenssl req -new -nodes -key client.key -out client.csr -days 3650 -subj \"/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName\" -config ./openssl.cnf -extensions v3_req\nopenssl x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req\n\n","chmod +x gen.sh\n./gen.sh\n","openssl genpkey -algorithm RSA -out ca.key\n","openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$Organizational/CN=$CommonName\"\n","openssl genpkey -algorithm RSA -out server.key\n","openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj \"/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName\" -config ./openssl.cnf -extensions v3_req\n","openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req\n","tls:\n  serverPemPath: /milvus/tls/server.pem\n  serverKeyPath: /milvus/tls/server.key\n  caPemPath: /milvus/tls/ca.pem\n\ncommon:\n  security:\n    tlsMode: 1\n","├── docker-compose.yml\n├── milvus.yaml\n└── tls\n     ├── server.pem\n     ├── server.key\n     └── ca.pem\n","  standalone:\n    container_name: milvus-standalone\n    image: milvusdb/milvus:latest\n    command: [\"milvus\", \"run\", \"standalone\"]\n    security_opt:\n    - seccomp:unconfined\n    environment:\n      ETCD_ENDPOINTS: etcd:2379\n      MINIO_ADDRESS: minio:9000\n    volumes:\n      - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n      - ${DOCKER_VOLUME_DIRECTORY:-.}/tls:/milvus/tls\n      - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n","sudo docker compose up -d\n","from pymilvus import MilvusClient\n\nclient = MilvusClient(\n    uri=\"https://localhost:19530\",\n    secure=True,\n    server_pem_path=\"path_to/server.pem\",\n    server_name=\"localhost\"\n)\n","from pymilvus import MilvusClient\n\nclient = MilvusClient(\n    uri=\"https://localhost:19530\",\n    secure=True,\n    client_pem_path=\"path_to/client.pem\",\n    client_key_path=\"path_to/client.key\",\n    ca_pem_path=\"path_to/ca.pem\",\n    server_name=\"localhost\"\n)\n","curl --cacert path_to/ca.pem https://localhost:19530/v2/vectordb/collections/list\n","curl --cert path_to/client.pem --key path_to/client.key --cacert path_to/ca.pem https://localhost:19530/v2/vectordb/collections/list\n"],"headingContent":"Encryption in Transit","anchorList":[{"label":"Encryption in Transit","href":"Encryption-in-Transit","type":1,"isActive":false},{"label":"Create your own certificate","href":"Create-your-own-certificate","type":2,"isActive":false},{"label":"Set up a Milvus server with TLS","href":"Set-up-a-Milvus-server-with-TLS","type":2,"isActive":false},{"label":"Connect to the Milvus server with TLS","href":"Connect-to-the-Milvus-server-with-TLS","type":2,"isActive":false},{"label":"Connect to the Milvus RESTful server with TLS","href":"Connect-to-the-Milvus-RESTful-server-with-TLS","type":2,"isActive":false}]}
\ No newline at end of file
+{"codeList":["openssl version\n","sudo apt install openssl\n","mkdir cert && cd cert\ntouch gen.sh\n","#!/usr/bin/env sh\n# your variables\nCountry=\"US\"\nState=\"CA\"\nLocation=\"Redwood City\"\nOrganization=\"zilliz\"\nOrganizationUnit=\"devops\"\nCommonName=\"localhost\"\nExpireDays=3650 # 10 years\n\n# generate private key for ca, server and client\nopenssl genpkey -quiet -algorithm rsa:2048 -out ca.key\nopenssl genpkey -quiet -algorithm rsa:2048 -out server.key\nopenssl genpkey -quiet -algorithm rsa:2048 -out client.key\n\n# create a new ca certificate\nopenssl req -x509 -new -nodes -key ca.key -sha256 -days 36500 -out ca.pem \\\n  -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName\"\n\n# prepare extension config for signing certificates\necho '[v3_req]\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\nsubjectAltName = @alt_names\n[alt_names]\nDNS = '$CommonName > openssl.cnf\n\n# sign server certificate with ca\nopenssl req -new -key server.key\\\n  -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName\"\\\n  | openssl x509 -req -days $ExpireDays -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial \\\n    -extfile ./openssl.cnf -extensions v3_req\n\n# sign client certificate with ca\nopenssl req -new -key client.key\\\n  -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName\"\\\n  | openssl x509 -req -days $ExpireDays -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial \\\n    -extfile ./openssl.cnf -extensions v3_req\n\n","chmod +x gen.sh\n./gen.sh\n","#!/usr/bin/env sh\n# your variables\nCountry=\"US\"\nState=\"CA\"\nLocation=\"Redwood City\"\nOrganization=\"zilliz\"\nOrganizationUnit=\"devops\"\nCommonName=\"localhost\"\nExpireDays=3650 # 10 years\n\n# generate private key for ca, server and client\nopenssl genpkey -quiet -algorithm rsa:2048 -out server.key\nopenssl genpkey -quiet -algorithm rsa:2048 -out client.key\n\n# prepare extension config for signing certificates\necho '[v3_req]\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\nsubjectAltName = @alt_names\n[alt_names]\nDNS = '$CommonName > openssl.cnf\n\n# sign server certificate with ca\nopenssl req -new -key server.key\\\n  -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName\"\\\n  | openssl x509 -req -days $ExpireDays -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial \\\n    -extfile ./openssl.cnf -extensions v3_req\n\n# sign client certificate with ca\nopenssl req -new -key client.key\\\n  -subj \"/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName\"\\\n  | openssl x509 -req -days $ExpireDays -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial \\\n    -extfile ./openssl.cnf -extensions v3_req\n","chmod +x renew.sh\n./renew.sh\n","proxy:\n  http:\n    # for now milvus do not support config restful on same port with grpc\n    # so we set to 8080, grpc will still use 19530\n    port: 8080 \ntls:\n  serverPemPath: /milvus/tls/server.pem\n  serverKeyPath: /milvus/tls/server.key\n  caPemPath: /milvus/tls/ca.pem\n\ncommon:\n  security:\n    tlsMode: 1\n","internaltls:\n  serverPemPath: /milvus/tls/server.pem\n  serverKeyPath: /milvus/tls/server.key\n  caPemPath: /milvus/tls/ca.pem\n\ncommon:\n  security:\n    internaltlsEnabled: true \n","├── docker-compose.yml\n├── milvus.yaml\n└── tls\n     ├── server.pem\n     ├── server.key\n     └── ca.pem\n","  standalone:\n    container_name: milvus-standalone\n    image: milvusdb/milvus:latest\n    command: [\"milvus\", \"run\", \"standalone\"]\n    security_opt:\n    - seccomp:unconfined\n    environment:\n      ETCD_ENDPOINTS: etcd:2379\n      MINIO_ADDRESS: minio:9000\n    volumes:\n      - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus\n      - ${DOCKER_VOLUME_DIRECTORY:-.}/tls:/milvus/tls\n      - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml\n","sudo docker compose up -d\n","├── milvus.yaml (to be created later)\n├── server.pem\n├── server.key\n└── ca.pem\n","kubectl create secret generic certs --from-file=server.pem --from-file=server.key --from-file=ca.pem\n","apiVersion: milvus.io/v1beta1\nkind: Milvus\nmetadata:\n  name: my-release\nspec:\n  config:\n    proxy:\n      http:\n        # for now not support config restful on same port with grpc\n        # so we set to 8080, grpc will still use 19530\n        port: 8080 \n    common:\n      security:\n        tlsMode: 1 # tlsMode for external service 1 for one-way TLS, 2 for Mutual TLS, 0 for disable\n    tls:\n      serverPemPath: /certs/server.pem\n      serverKeyPath: /certs/server.key\n      caPemPath: /certs/ca.pem\n  components:\n    # mount the certs secret to the milvus container\n    volumes:\n      - name: certs\n        secret:\n          secretName: certs\n    volumeMounts:\n      - name: certs\n        mountPath: /certs\n        readOnly: true\n","apiVersion: milvus.io/v1beta1\nkind: Milvus\nmetadata:\n  name: my-release\nspec:\n  config:\n    proxy:\n      http:\n        # for now not support config restful on same port with grpc\n        # so we set to 8080, grpc will still use 19530\n        port: 8080 \n    common:\n      security:\n        internaltlsEnabled: true # whether to enable internal tls\n    # Configure tls certificates path for internal service\n    internaltls:\n      serverPemPath: /certs/server.pem\n      serverKeyPath: /certs/server.key\n      caPemPath: /certs/ca.pem\n      sni: localhost # the CommonName in your certificates\n  components:\n    # mount the certs secret to the milvus container\n    volumes:\n      - name: certs\n        secret:\n          secretName: certs\n    volumeMounts:\n      - name: certs\n        mountPath: /certs\n        readOnly: true\n","kubectl create -f milvus.yaml\n","├── values.yaml (to be created later)\n├── server.pem\n├── server.key\n└── ca.pem\n","kubectl create secret generic certs --from-file=server.pem --from-file=server.key --from-file=ca.pem\n","extraConfigFiles:\n  user.yaml: |+\n    proxy:\n      http:\n        # for now not support config restful on same port with grpc\n        # so we set to 8080, grpc will still use 19530\n        port: 8080 \n    common:\n      security:\n        tlsMode: 1 # tlsMode for external service 1 means set to 2 to enable Mutual TLS\n    # Configure tls certificates path for external service\n    tls:\n      serverPemPath: /certs/server.pem\n      serverKeyPath: /certs/server.key\n      caPemPath: /certs/ca.pem\n# mount the certs secret to the milvus container\nvolumes:\n  - name: certs\n    secret:\n      secretName: certs\nvolumeMounts:\n  - name: certs\n    mountPath: /certs\n    readOnly: true\n","extraConfigFiles:\n  user.yaml: |+\n    common:\n      security:\n        internaltlsEnabled: true # whether to enable internal tls\n    # Configure tls certificates path for internal service\n    internaltls:\n      serverPemPath: /certs/server.pem\n      serverKeyPath: /certs/server.key\n      caPemPath: /certs/ca.pem\n      sni: localhost\n# mount the certs secret to the milvus container\nvolumes:\n  - name: certs\n    secret:\n      secretName: certs\nvolumeMounts:\n  - name: certs\n    mountPath: /certs\n    readOnly: true\n","helm repo add milvus https://zilliztech.github.io/milvus-helm/\nhelm repo update milvus\nhelm install my-release milvus/milvus -f values.yaml\n","[...date time...] [INFO] [utils/util.go:56] [\"Internal TLS Enabled\"] [value=true]\n","from pymilvus import MilvusClient\n\nclient = MilvusClient(\n    uri=\"https://localhost:19530\",\n    secure=True,\n    server_pem_path=\"path_to/server.pem\",\n    server_name=\"localhost\"\n)\n","from pymilvus import MilvusClient\n\nclient = MilvusClient(\n    uri=\"https://localhost:19530\",\n    secure=True,\n    client_pem_path=\"path_to/client.pem\",\n    client_key_path=\"path_to/client.key\",\n    ca_pem_path=\"path_to/ca.pem\",\n    server_name=\"localhost\"\n)\n","curl --cacert path_to/ca.pem https://localhost:8080/v2/vectordb/collections/list\n","curl --cert path_to/client.pem --key path_to/client.key --cacert path_to/ca.pem https://localhost:8080/v2/vectordb/collections/list\n"],"headingContent":"Encryption in Transit","anchorList":[{"label":"Encryption in Transit","href":"Encryption-in-Transit","type":1,"isActive":false},{"label":"Create your own certificate","href":"Create-your-own-certificate","type":2,"isActive":false},{"label":"Set up a Milvus server with TLS","href":"Set-up-a-Milvus-server-with-TLS","type":2,"isActive":false},{"label":"Verify Internal TLS enabled","href":"Verify-Internal-TLS-enabled","type":2,"isActive":false},{"label":"Connect to the Milvus server with TLS","href":"Connect-to-the-Milvus-server-with-TLS","type":2,"isActive":false},{"label":"Connect to the Milvus RESTful server with TLS","href":"Connect-to-the-Milvus-RESTful-server-with-TLS","type":2,"isActive":false}]}
\ No newline at end of file
diff --git a/localization/v2.5.x/site/en/adminGuide/tls.md b/localization/v2.5.x/site/en/adminGuide/tls.md
index 4f25ba834..e2e4799ea 100644
--- a/localization/v2.5.x/site/en/adminGuide/tls.md
+++ b/localization/v2.5.x/site/en/adminGuide/tls.md
@@ -45,395 +45,55 @@ summary: Learn how to enable TLS proxy in Milvus.
 
sudo apt install openssl
 

 
Create files
    
-
  1. Create the openssl.cnf and gen.sh files.
    2. 
+
  2. Create the gen.sh file.
    3. 
 

 
mkdir cert && cd cert
-touch openssl.cnf gen.sh
+touch gen.sh
 

 
    
-
  1. Copy the following configurations into the files respectively.
    2. 
+
  2. Copy the following script into the gen.sh.
    3. 
 

-
openssl.cnf

-
#
-# OpenSSL example configuration file.
-# This is mostly being used for generation of certificate requests.
-#
-
-# This definition stops the following lines choking if HOME isn't
-# defined.
-HOME            = .
-RANDFILE        = $ENV::HOME/.rnd
-
-# Extra OBJECT IDENTIFIER info:
-#oid_file       = $ENV::HOME/.oid
-oid_section     = new_oids
-
-# To use this configuration file with the "-extfile" option of the
-# "openssl x509" utility, name here the section containing the
-# X.509v3 extensions to use:
-# extensions        = 
-# (Alternatively, use a configuration file that has only
-# X.509v3 extensions in its main [= default] section.)
-
-[ new_oids ]
-
-# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
-# Add a simple OID like this:
-# testoid1=1.2.3.4
-# Or use config file substitution like this:
-# testoid2=${testoid1}.5.6
-
-# Policies used by the TSA examples.
-tsa_policy1 = 1.2.3.4.1
-tsa_policy2 = 1.2.3.4.5.6
-tsa_policy3 = 1.2.3.4.5.7
-
-####################################################################
-[ ca ]
-default_ca  = CA_default        # The default ca section
-
-####################################################################
-[ CA_default ]
-
-dir     = ./demoCA      # Where everything is kept
-certs       = $dir/certs        # Where the issued certs are kept
-crl_dir     = $dir/crl      # Where the issued crl are kept
-database    = $dir/index.txt    # database index file.
-#unique_subject = no            # Set to 'no' to allow creation of
-                    # several ctificates with same subject.
-new_certs_dir   = $dir/newcerts     # default place for new certs.
-
-certificate = $dir/cacert.pem   # The CA certificate
-serial      = $dir/serial       # The current serial number
-crlnumber   = $dir/crlnumber    # the current crl number
-                    # must be commented out to leave a V1 CRL
-crl     = $dir/crl.pem      # The current CRL
-private_key = $dir/private/cakey.pem# The private key
-RANDFILE    = $dir/private/.rand    # private random number file
-
-x509_extensions = usr_cert      # The extentions to add to the cert
-
-# Comment out the following two lines for the "traditional"
-# (and highly broken) format.
-name_opt    = ca_default        # Subject Name options
-cert_opt    = ca_default        # Certificate field options
-
-# Extension copying option: use with caution.
-copy_extensions = copy
-
-# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
-# so this is commented out by default to leave a V1 CRL.
-# crlnumber must also be commented out to leave a V1 CRL.
-# crl_extensions    = crl_ext
-
-default_days    = 365           # how long to certify for
-default_crl_days= 30            # how long before next CRL
-default_md  = default       # use public key default MD
-preserve    = no            # keep passed DN ordering
-
-# A few difference way of specifying how similar the request should look
-# For type CA, the listed attributes must be the same, and the optional
-# and supplied fields are just that :-)
-policy      = policy_match
-
-# For the CA policy
-[ policy_match ]
-countryName     = match
-stateOrProvinceName = match
-organizationName    = match
-organizationalUnitName  = optional
-commonName      = supplied
-emailAddress        = optional
-
-# For the 'anything' policy
-# At this point in time, you must list all acceptable 'object'
-# types.
-[ policy_anything ]
-countryName     = optional
-stateOrProvinceName = optional
-localityName        = optional
-organizationName    = optional
-organizationalUnitName  = optional
-commonName      = supplied
-emailAddress        = optional
-
-####################################################################
-[ req ]
-default_bits        = 2048
-default_keyfile     = privkey.pem
-distinguished_name  = req_distinguished_name
-attributes      = req_attributes
-x509_extensions = v3_ca # The extentions to add to the self signed cert
-
-# Passwords for private keys if not present they will be prompted for
-# input_password = secret
-# output_password = secret
-
-# This sets a mask for permitted string types. There are several options. 
-# default: PrintableString, T61String, BMPString.
-# pkix   : PrintableString, BMPString (PKIX recommendation before 2004)
-# utf8only: only UTF8Strings (PKIX recommendation after 2004).
-# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
-# MASK:XXXX a literal mask value.
-# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
-string_mask = utf8only
-
-req_extensions = v3_req # The extensions to add to a certificate request
-
-[ req_distinguished_name ]
-countryName         = Country Name (2 letter code)
-countryName_default     = AU
-countryName_min         = 2
-countryName_max         = 2
-
-stateOrProvinceName     = State or Province Name (full name)
-stateOrProvinceName_default = Some-State
-
-localityName            = Locality Name (eg, city)
-
-0.organizationName      = Organization Name (eg, company)
-0.organizationName_default  = Internet Widgits Pty Ltd
-
-# we can do this but it is not needed normally :-)
-#1.organizationName     = Second Organization Name (eg, company)
-#1.organizationName_default = World Wide Web Pty Ltd
-
-organizationalUnitName      = Organizational Unit Name (eg, section)
-#organizationalUnitName_default =
-
-commonName          = Common Name (e.g. server FQDN or YOUR name)
-commonName_max          = 64
-
-emailAddress            = Email Address
-emailAddress_max        = 64
-
-# SET-ex3           = SET extension number 3
-
-[ req_attributes ]
-challengePassword       = A challenge password
-challengePassword_min       = 4
-challengePassword_max       = 20
-
-unstructuredName        = An optional company name
-
-[ usr_cert ]
-
-# These extensions are added when 'ca' signs a request.
-
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-
-basicConstraints=CA:FALSE
-
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-
-# This is OK for an SSL server.
-# nsCertType            = server
-
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-
-# For normal client use this is typical
-# nsCertType = client, email
-
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-# This will be displayed in Netscape's comment listbox.
-nsComment           = "OpenSSL Generated Certificate"
-
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-
-# Copy subject details
-# issuerAltName=issuer:copy
-
-#nsCaRevocationUrl      = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-
-# This is required for TSA certificates.
-# extendedKeyUsage = critical,timeStamping
-
-[ v3_req ]
-
-# Extensions to add to a certificate request
-
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-
-[ v3_ca ]
-
-
-# Extensions for a typical CA
-
-
-# PKIX recommendation.
-
-subjectKeyIdentifier=hash
-
-authorityKeyIdentifier=keyid:always,issuer
-
-# This is what PKIX recommends but some broken software chokes on critical
-# extensions.
-#basicConstraints = critical,CA:true
-# So we do this instead.
-basicConstraints = CA:true
-
-# Key usage: this is typical for a CA certificate. However since it will
-# prevent it being used as an test self-signed certificate it is best
-# left out by default.
-# keyUsage = cRLSign, keyCertSign
-
-# Some might want this also
-# nsCertType = sslCA, emailCA
-
-# Include email address in subject alt name: another PKIX recommendation
-# subjectAltName=email:copy
-# Copy issuer details
-# issuerAltName=issuer:copy
-
-# DER hex encoding of an extension: beware experts only!
-# obj=DER:02:03
-# Where 'obj' is a standard or added object
-# You can even override a supported extension:
-# basicConstraints= critical, DER:30:03:01:01:FF
-
-[ crl_ext ]
-
-# CRL extensions.
-# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
-
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-
-[ proxy_cert_ext ]
-# These extensions should be added when creating a proxy certificate
-
-# This goes against PKIX guidelines but some CAs do it and some software
-# requires this to avoid interpreting an end user certificate as a CA.
-
-basicConstraints=CA:FALSE
-
-# Here are some examples of the usage of nsCertType. If it is omitted
-# the certificate can be used for anything *except* object signing.
-
-# This is OK for an SSL server.
-# nsCertType            = server
-
-# For an object signing certificate this would be used.
-# nsCertType = objsign
-
-# For normal client use this is typical
-# nsCertType = client, email
-
-# and for everything including object signing:
-# nsCertType = client, email, objsign
-
-# This is typical in keyUsage for a client certificate.
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-
-# This will be displayed in Netscape's comment listbox.
-nsComment           = "OpenSSL Generated Certificate"
-
-# PKIX recommendations harmless if included in all certificates.
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-
-# This stuff is for subjectAltName and issuerAltname.
-# Import the email address.
-# subjectAltName=email:copy
-# An alternative to produce certificates that aren't
-# deprecated according to PKIX.
-# subjectAltName=email:move
-
-# Copy subject details
-# issuerAltName=issuer:copy
-
-#nsCaRevocationUrl      = http://www.domain.dom/ca-crl.pem
-#nsBaseUrl
-#nsRevocationUrl
-#nsRenewalUrl
-#nsCaPolicyUrl
-#nsSslServerName
-
-# This really needs to be in place for it to be a proxy certificate.
-proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
-
-####################################################################
-[ tsa ]
-
-default_tsa = tsa_config1   # the default TSA section
-
-[ tsa_config1 ]
-
-# These are used by the TSA reply generation only.
-dir     = ./demoCA      # TSA root directory
-serial      = $dir/tsaserial    # The current serial number (mandatory)
-crypto_device   = builtin       # OpenSSL engine to use for signing
-signer_cert = $dir/tsacert.pem  # The TSA signing certificate
-                    # (optional)
-certs       = $dir/cacert.pem   # Certificate chain to include in reply
-                    # (optional)
-signer_key  = $dir/private/tsakey.pem # The TSA private key (optional)
-
-default_policy  = tsa_policy1       # Policy if request did not specify it
-                    # (optional)
-other_policies  = tsa_policy2, tsa_policy3  # acceptable policies (optional)
-digests     = md5, sha1     # Acceptable message digests (mandatory)
-accuracy    = secs:1, millisecs:500, microsecs:100  # (optional)
-clock_precision_digits  = 0 # number of digits after dot. (optional)
-ordering        = yes   # Is ordering defined for timestamps?
-                # (optional, default: no)
-tsa_name        = yes   # Must the TSA name be included in the reply?
-                # (optional, default: no)
-ess_cert_id_chain   = no    # Must the ESS cert id chain be included?
-                # (optional, default: no)
-

-

-
The openssl.cnf file is a default OpenSSL configuration file. See manual page for more information. The gen.sh file generates relevant certificate files. You can modify the gen.sh file for different purposes such as changing the validity period of the certificate file, the length of the certificate key or the certificate file names.

 
It is necessary to configure the CommonName in the gen.sh file. The CommonName refers to the server name that the client should specify while connecting.

 
gen.sh

 
#!/usr/bin/env sh
 # your variables
-Country="CN"
-State="Shanghai"
-Location="Shanghai"
-Organization="milvus"
-Organizational="milvus"
+Country="US"
+State="CA"
+Location="Redwood City"
+Organization="zilliz"
+OrganizationUnit="devops"
 CommonName="localhost"
+ExpireDays=3650 # 10 years
 
-echo "generate ca.key"
-openssl genrsa -out ca.key 2048
-
-echo "generate ca.pem"
-openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$Organizational/CN=$CommonName"
+# generate private key for ca, server and client
+openssl genpkey -quiet -algorithm rsa:2048 -out ca.key
+openssl genpkey -quiet -algorithm rsa:2048 -out server.key
+openssl genpkey -quiet -algorithm rsa:2048 -out client.key
 
-echo "generate server SAN certificate"
-openssl genpkey -algorithm RSA -out server.key
-openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName" -config ./openssl.cnf -extensions v3_req
-openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
+# create a new ca certificate
+openssl req -x509 -new -nodes -key ca.key -sha256 -days 36500 -out ca.pem \
+  -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName"
 
-echo "generate client SAN certificate"
-openssl genpkey -algorithm RSA -out client.key
-openssl req -new -nodes -key client.key -out client.csr -days 3650 -subj "/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName" -config ./openssl.cnf -extensions v3_req
-openssl x509 -req -days 3650 -in client.csr -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
+# prepare extension config for signing certificates
+echo '[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+[alt_names]
+DNS = '$CommonName > openssl.cnf
+
+# sign server certificate with ca
+openssl req -new -key server.key\
+  -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName"\
+  | openssl x509 -req -days $ExpireDays -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial \
+    -extfile ./openssl.cnf -extensions v3_req
+
+# sign client certificate with ca
+openssl req -new -key client.key\
+  -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName"\
+  | openssl x509 -req -days $ExpireDays -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial \
+    -extfile ./openssl.cnf -extensions v3_req
 
 

 

@@ -442,40 +102,49 @@ openssl x509 -req -days 3650 -in client.csr -o
 
chmod +x gen.sh
 ./gen.sh
 

-
The following nine files will be created: ca.key, ca.pem, ca.srl, server.key, server.pem, server.csr, client.key, client.pem, client.csr.

-
Modify the detail of certificate files (optional)
After generating the certificate, you can modify the detail of the certificate files according to your own need.

-
The implementation of SSL or TSL mutual authentication involves a client, a server, and a certificate authority (CA). A CA is used to ensure that the certificate between a client and a server is legal.

-
Run man openssl or see the openssl manual page for more information about using the OpenSSL command.

-
    
-
  1. Generate an RSA private key for the ca.
    2. 
-

-
openssl genpkey -algorithm RSA -out ca.key
-

-
    
-
  1. Request CA certificate generation.
    2. 
-

-
You need to provide the basic information about the CA in this step. Choose the x509 option to skip the request and directly generate a self-signing certificate.

-
openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$Organizational/CN=$CommonName"
-

-
You will get a ca.pem file , a CA certificate that can be used to generate client-server certificates after this step.

-
    
-
  1. Generate a server private key.
    2. 
-

-
openssl genpkey -algorithm RSA -out server.key
-

-
You will get a server.key file after this step.

-
    
-
  1. Generate a certificate signing request file.
    2. 
-

-
You need to provide the required information about the server to generate a certificate signing request file.

-
openssl req -new -nodes -key server.key -out server.csr -days 3650 -subj "/C=$Country/O=$Organization/OU=$Organizational/CN=$CommonName" -config ./openssl.cnf -extensions v3_req
+
The following seven files will be created: ca.key, ca.pem, ca.srl, server.key, server.pem, client.key, client.pem.

+
Be sure to keep the ca.key, ca.pem, ca.srl secure in order to renew your certificates later. The server.key and server.pem files are used by the server, and the client.key and client.pem files are used by the client.

+
Renew certificates (optional)
If you want to renew the certificates in some cases, for example if they will soon expire. you can use the following script.

+
You need ca.key, ca.pem, ca.srl in your working directory.

+
renew.sh

+
#!/usr/bin/env sh
+# your variables
+Country="US"
+State="CA"
+Location="Redwood City"
+Organization="zilliz"
+OrganizationUnit="devops"
+CommonName="localhost"
+ExpireDays=3650 # 10 years
+
+# generate private key for ca, server and client
+openssl genpkey -quiet -algorithm rsa:2048 -out server.key
+openssl genpkey -quiet -algorithm rsa:2048 -out client.key
+
+# prepare extension config for signing certificates
+echo '[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+[alt_names]
+DNS = '$CommonName > openssl.cnf
+
+# sign server certificate with ca
+openssl req -new -key server.key\
+  -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName"\
+  | openssl x509 -req -days $ExpireDays -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial \
+    -extfile ./openssl.cnf -extensions v3_req
+
+# sign client certificate with ca
+openssl req -new -key client.key\
+  -subj "/C=$Country/ST=$State/L=$Location/O=$Organization/OU=$OrganizationUnit/CN=$CommonName"\
+  | openssl x509 -req -days $ExpireDays -out client.pem -CA ca.pem -CAkey ca.key -CAcreateserial \
+    -extfile ./openssl.cnf -extensions v3_req
 

-
You will get a server.csr file after this step.

-
    
-
  1. Sign the certificate.
    2. 
-

-
Open the server.csr, the ca.key and the ca.pem files to sign the certificate. The CAcreateserial command option is used to create a CA serial number file if it does not exist. You will get an aca.srl file after choosing this command option.

-
openssl x509 -req -days 3650 -in server.csr -out server.pem -CA ca.pem -CAkey ca.key -CAcreateserial -extfile ./openssl.cnf -extensions v3_req
+
Run the renew.sh file to create certificate.

+
chmod +x renew.sh
+./renew.sh
 

 
Set up a Milvus server with TLS
This section outlines the steps to configure a Milvus server with TLS encryption.

-

-
This guide focuses on deployment using Docker Compose. For information on Milvus Operator deployment, refer to Milvus Operator TLS documentation.

-

-
1. Modify the Milvus server configuration
To enable TLS, set common.security.tlsMode in milvus.yaml to 1 (for one-way TLS) or 2 (for two-way TLS).

-
tls:
+
Setup for Docker Compose
1. Modify the Milvus server configuration
To enable external TLS, add the following configurations in the milvus.yaml file:

+
proxy:
+  http:
+    # for now milvus do not support config restful on same port with grpc
+    # so we set to 8080, grpc will still use 19530
+    port: 8080 
+tls:
+  serverPemPath: /milvus/tls/server.pem
+  serverKeyPath: /milvus/tls/server.key
+  caPemPath: /milvus/tls/ca.pem
+
+common:
+  security:
+    tlsMode: 1
+

+
Parameters:

+
    
+
  • serverPemPath: The path to the server certificate file.
    • 
+
  • serverKeyPath: The path to the server key file.
    • 
+
  • caPemPath: The path to the CA certificate file.
    • 
+
  • tlsMode: The TLS mode for external service. Valid values:
+
      
+
    • 1: One-way authentication, where only the server requires a certificate and the client verifies it. This mode requires server.pem and server.key from the server side, and server.pem from the client side.
      • 
+
    • 2: Two-way authentication, where both the server and the client require certificates to establish a secure connection. This mode requires server.pem, server.key, and ca.pem from the server side, and client.pem, client.key, and ca.pem from the client side.
      • 
+
    • 
+

+
To enable internal TLS, add the following configurations in the milvus.yaml file:

+
internaltls:
   serverPemPath: /milvus/tls/server.pem
   serverKeyPath: /milvus/tls/server.key
   caPemPath: /milvus/tls/ca.pem
 
 common:
   security:
-    tlsMode: 1
+    internaltlsEnabled: true 
 

 
Parameters:

 
    
 
  • serverPemPath: The path to the server certificate file.
    • 
 
  • serverKeyPath: The path to the server key file.
    • 
 
  • caPemPath: The path to the CA certificate file.
    • 
-
  • tlsMode: The TLS mode for encryption. Valid values:
-
      
-
    • 1: One-way authentication, where only the server requires a certificate and the client verifies it. This mode requires server.pem and server.key from the server side, and server.pem from the client side.
      • 
-
    • 2: Two-way authentication, where both the server and the client require certificates to establish a secure connection. This mode requires server.pem, server.key, and ca.pem from the server side, and client.pem, client.key, and ca.pem from the client side.
      • 
-
    • 
+
  • internaltlsEnabled: Whether to enable internal TLS. For now only one-way tls is supported.
    • 
 

-
2. Map certificate files to the container
Prepare certificate files
Create a new folder named tls in the same directory as your docker-compose.yaml. Copy the server.pem, server.key, and ca.pem into the tls folder. Place them in a directory structure as follows:

+
2. Map certificate files to the container
Prepare certificate files
Create a new folder named tls in the same directory as your docker-compose.yaml. Copy the server.pem, server.key, and ca.pem into the tls folder. Place them in a directory structure as follows:

 
├── docker-compose.yml
 ├── milvus.yaml
 └── tls
@@ -540,9 +228,166 @@ openssl x509 -req -days 3650 -in client.csr -o
       - ${DOCKER_VOLUME_DIRECTORY:-.}/tls:/milvus/tls
       - ${DOCKER_VOLUME_DIRECTORY:-.}/milvus.yaml:/milvus/configs/milvus.yaml
 

-
Deploy Milvus using Docker Compose
Execute the following command to deploy Milvus:

+
Deploy Milvus using Docker Compose
Execute the following command to deploy Milvus:

 
sudo docker compose up -d
 

+
Setup for Milvus Operator
Put the certificate files in your working directory. The directory structure should look like this:

+
├── milvus.yaml (to be created later)
+├── server.pem
+├── server.key
+└── ca.pem
+

+
Create a secret with the certificate files:

+
kubectl create secret generic certs --from-file=server.pem --from-file=server.key --from-file=ca.pem
+

+
To enable external TLS, add the following configurations in the milvus.yaml file:

+
apiVersion: milvus.io/v1beta1
+kind: Milvus
+metadata:
+  name: my-release
+spec:
+  config:
+    proxy:
+      http:
+        # for now not support config restful on same port with grpc
+        # so we set to 8080, grpc will still use 19530
+        port: 8080 
+    common:
+      security:
+        tlsMode: 1 # tlsMode for external service 1 for one-way TLS, 2 for Mutual TLS, 0 for disable
+    tls:
+      serverPemPath: /certs/server.pem
+      serverKeyPath: /certs/server.key
+      caPemPath: /certs/ca.pem
+  components:
+    # mount the certs secret to the milvus container
+    volumes:
+      - name: certs
+        secret:
+          secretName: certs
+    volumeMounts:
+      - name: certs
+        mountPath: /certs
+        readOnly: true
+

+
To enable internal TLS, add the following configurations in the milvus.yaml file:

+
Remember to replace the internaltls.sni field with the CommonName in your certificates.

+
apiVersion: milvus.io/v1beta1
+kind: Milvus
+metadata:
+  name: my-release
+spec:
+  config:
+    proxy:
+      http:
+        # for now not support config restful on same port with grpc
+        # so we set to 8080, grpc will still use 19530
+        port: 8080 
+    common:
+      security:
+        internaltlsEnabled: true # whether to enable internal tls
+    # Configure tls certificates path for internal service
+    internaltls:
+      serverPemPath: /certs/server.pem
+      serverKeyPath: /certs/server.key
+      caPemPath: /certs/ca.pem
+      sni: localhost # the CommonName in your certificates
+  components:
+    # mount the certs secret to the milvus container
+    volumes:
+      - name: certs
+        secret:
+          secretName: certs
+    volumeMounts:
+      - name: certs
+        mountPath: /certs
+        readOnly: true
+

+
create the Milvus CR:

+
kubectl create -f milvus.yaml
+

+
setup for Milvus Helm
Put the certificate files in your working directory. The directory structure should look like this:

+
├── values.yaml (to be created later)
+├── server.pem
+├── server.key
+└── ca.pem
+

+
Create a secret with the certificate files:

+
kubectl create secret generic certs --from-file=server.pem --from-file=server.key --from-file=ca.pem
+

+
To enable external TLS, add the following configurations in the values.yaml file:

+
extraConfigFiles:
+  user.yaml: |+
+    proxy:
+      http:
+        # for now not support config restful on same port with grpc
+        # so we set to 8080, grpc will still use 19530
+        port: 8080 
+    common:
+      security:
+        tlsMode: 1 # tlsMode for external service 1 means set to 2 to enable Mutual TLS
+    # Configure tls certificates path for external service
+    tls:
+      serverPemPath: /certs/server.pem
+      serverKeyPath: /certs/server.key
+      caPemPath: /certs/ca.pem
+# mount the certs secret to the milvus container
+volumes:
+  - name: certs
+    secret:
+      secretName: certs
+volumeMounts:
+  - name: certs
+    mountPath: /certs
+    readOnly: true
+

+
To enable internal TLS, add the following configurations in the values.yaml file:

+
Remember to replace the internaltls.sni field with the CommonName in your certificates.

+
extraConfigFiles:
+  user.yaml: |+
+    common:
+      security:
+        internaltlsEnabled: true # whether to enable internal tls
+    # Configure tls certificates path for internal service
+    internaltls:
+      serverPemPath: /certs/server.pem
+      serverKeyPath: /certs/server.key
+      caPemPath: /certs/ca.pem
+      sni: localhost
+# mount the certs secret to the milvus container
+volumes:
+  - name: certs
+    secret:
+      secretName: certs
+volumeMounts:
+  - name: certs
+    mountPath: /certs
+    readOnly: true
+

+
Create the milvus release:

+
helm repo add milvus https://zilliztech.github.io/milvus-helm/
+helm repo update milvus
+helm install my-release milvus/milvus -f values.yaml
+

+
Verify Internal TLS enabled
It’s difficult to verify internal TLS directly. You can check the Milvus log to see if internal TLS is enabled.

+
In the Milvus log, you should see the following message if internal TLS is enabled:

+
[...date time...] [INFO] [utils/util.go:56] ["Internal TLS Enabled"] [value=true]
+

 
Connect to the Milvus server with TLS
For RESTful APIs, you can check tls by using the curl command.

-
One-way TLS connection
curl --cacert path_to/ca.pem https://localhost:19530/v2/vectordb/collections/list
+
One-way TLS connection
curl --cacert path_to/ca.pem https://localhost:8080/v2/vectordb/collections/list
 

-
Two-way TLS connection
curl --cert path_to/client.pem --key path_to/client.key --cacert path_to/ca.pem https://localhost:19530/v2/vectordb/collections/list
+
Two-way TLS connection
curl --cert path_to/client.pem --key path_to/client.key --cacert path_to/ca.pem https://localhost:8080/v2/vectordb/collections/list
 

diff --git a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.json b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.json
index a97a24a1b..9679307d7 100644
--- a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.json
+++ b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.json
@@ -1 +1 @@
-{"codeList":["# Download the configuration file\n$ wget https://github.com/milvus-io/milvus/releases/download/v2.5.0-beta/milvus-standalone-docker-compose.yml -O docker-compose.yml\n\n# Start Milvus\n$ sudo docker-compose up -d\n\nCreating milvus-etcd  ... done\nCreating milvus-minio ... done\nCreating milvus-standalone ... done\n","$ sudo docker-compose ps\n\n      Name                     Command                  State                            Ports\n--------------------------------------------------------------------------------------------------------------------\nmilvus-etcd         etcd -advertise-client-url ...   Up             2379/tcp, 2380/tcp\nmilvus-minio        /usr/bin/docker-entrypoint ...   Up (healthy)   9000/tcp\nmilvus-standalone   /tini -- milvus run standalone   Up             0.0.0.0:19530->19530/tcp, 0.0.0.0:9091->9091/tcp\n","# Stop Milvus\n$ sudo docker-compose down\n\n# Delete service data\n$ sudo rm -rf volumes\n"],"headingContent":"Run Milvus with Docker Compose (Linux)","anchorList":[{"label":"Run Milvus with Docker Compose (Linux)","href":"Run-Milvus-with-Docker-Compose-Linux","type":1,"isActive":false},{"label":"Prerequisites","href":"Prerequisites","type":2,"isActive":false},{"label":"Install Milvus","href":"Install-Milvus","type":2,"isActive":false},{"label":"What's next","href":"Whats-next","type":2,"isActive":false}]}
\ No newline at end of file
+{"codeList":["# Download the configuration file\n$ wget https://github.com/milvus-io/milvus/releases/download/v2.5.0-beta/milvus-standalone-docker-compose.yml -O docker-compose.yml\n\n# Start Milvus\n$ sudo docker compose up -d\n\nCreating milvus-etcd  ... done\nCreating milvus-minio ... done\nCreating milvus-standalone ... done\n","$ sudo docker-compose ps\n\n      Name                     Command                  State                            Ports\n--------------------------------------------------------------------------------------------------------------------\nmilvus-etcd         etcd -advertise-client-url ...   Up             2379/tcp, 2380/tcp\nmilvus-minio        /usr/bin/docker-entrypoint ...   Up (healthy)   9000/tcp\nmilvus-standalone   /tini -- milvus run standalone   Up             0.0.0.0:19530->19530/tcp, 0.0.0.0:9091->9091/tcp\n","# Stop Milvus\n$ sudo docker compose down\n\n# Delete service data\n$ sudo rm -rf volumes\n"],"headingContent":"Run Milvus with Docker Compose (Linux)","anchorList":[{"label":"Run Milvus with Docker Compose (Linux)","href":"Run-Milvus-with-Docker-Compose-Linux","type":1,"isActive":false},{"label":"Prerequisites","href":"Prerequisites","type":2,"isActive":false},{"label":"Install Milvus","href":"Install-Milvus","type":2,"isActive":false},{"label":"What's next","href":"Whats-next","type":2,"isActive":false}]}
\ No newline at end of file
diff --git a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.md b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.md
index 002e470e2..9843e5b4b 100644
--- a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.md
+++ b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-docker-compose.md
@@ -60,7 +60,7 @@ title: Run Milvus with Docker Compose (Linux)
 $ wget https://github.com/milvus-io/milvus/releases/download/v2.5.0-beta/milvus-standalone-docker-compose.yml -O docker-compose.yml
 
 # Start Milvus
-$ sudo docker-compose up -d
+$ sudo docker compose up -d
 
 Creating milvus-etcd  ... done
 Creating milvus-minio ... done
@@ -92,7 +92,7 @@ milvus-standalone   /tini -- milvus run standalone   Up             0.0.0.0:1953
 

 
You can stop and delete this container as follows

 
# Stop Milvus
-$ sudo docker-compose down
+$ sudo docker compose down
 
 # Delete service data
 $ sudo rm -rf volumes
diff --git a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.json b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.json
index a3abf86da..d95c71830 100644
--- a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.json
+++ b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.json
@@ -1 +1 @@
-{"codeList":["C:\\>Invoke-WebRequest https://github.com/milvus-io/milvus/blob/master/scripts/standalone_embed.bat -OutFile standalone.bat​\n\n","C:\\>standalone.bat start​\nWait for Milvus starting...​\nStart successfully.​\nTo change the default Milvus configuration, edit user.yaml and restart the service.​\n\n","# Stop Milvus​\nC:\\>standalone.bat stop​\nStop successfully.​\n​\n# Delete Milvus container​\nC:\\>standalone.bat delete​\nDelete Milvus container successfully. # Container has been removed.​\nDelete successfully. # Data has been removed.​\n\n","C:\\>wsl --install​\nUbuntu already installed.​\nStarting Ubuntu...​\n\n","# Download the installation script​\n$ curl -sfL https://raw.githubusercontent.com/milvus-io/milvus/master/scripts/standalone_embed.sh -o standalone_embed.sh​\n​\n# Start the Docker container​\n$ bash standalone_embed.sh start​\n\n","$ bash standalone_embed.sh start​\nWait for Milvus Starting...​\nStart successfully.​\nTo change the default Milvus configuration, add your settings to the user.yaml file and then restart the service.​\n\n","# Stop Milvus​\n$ bash standalone_embed.sh stop​\nStop successfully.​\n​\n# Delete Milvus data​\n$ bash standalone_embed.sh stop​\nDelete Milvus container successfully.​\nDelete successfully.​\n\n","# Download the configuration file and rename it as docker-compose.yml​\nC:\\>Invoke-WebRequest https://github.com/milvus-io/milvus/releases/download/v2.4.15/milvus-standalone-docker-compose.yml -OutFile docker-compose.yml​\n​\n# Start Milvus​\nC:\\>docker-compose up -d​\nCreating milvus-etcd  ... done​\nCreating milvus-minio ... done​\nCreating milvus-standalone ... done​\n\n","C:\\>wsl --install​\nUbuntu already installed.​\nStarting Ubuntu...​\n\n","$ wget https://github.com/milvus-io/milvus/releases/download/v2.4.17/milvus-standalone-docker-compose.yml -O docker-compose.yml​\n\n","$ sudo docker-compose up -d​\n​\nCreating milvus-etcd  ... done​\nCreating milvus-minio ... done​\nCreating milvus-standalone ... done​\n\n","C:\\>net start com.docker.service​\nThe Docker for Windows Service service is starting.​\nThe Docker for Windows Service service was started successfully.​\n\n","C:\\>wsl --update​\nChecking for updates.​\nThe most recent version of Windows Subsystem for Linux is already installed.​\n\n","C:\\>cd \"C:\\Program Files\\Docker\\Docker\"​\nC:\\Program Files\\Docker\\Docker>.\\DockerCli.exe -SwitchDaemon​\nSwitching to windows engine: Post \"http://ipc/engine/switch\": open \\\\.\\pipe\\dockerBackendApiServer: The system cannot find the file specified.​\n\n"],"headingContent":"Run Milvus in Docker (Windows)","anchorList":[{"label":"Run Milvus in Docker (Windows)","href":"Run-Milvus-in-Docker-Windows","type":1,"isActive":false},{"label":"Prerequisites​","href":"Prerequisites​","type":2,"isActive":false},{"label":"Run Milvus in Docker​","href":"Run-Milvus-in-Docker​","type":2,"isActive":false},{"label":"Run Milvus with Docker Compose​","href":"Run-Milvus-with-Docker-Compose​","type":2,"isActive":false},{"label":"FAQs​","href":"FAQs​","type":2,"isActive":false}]}
\ No newline at end of file
+{"codeList":["C:\\>Invoke-WebRequest https://github.com/milvus-io/milvus/blob/master/scripts/standalone_embed.bat -OutFile standalone.bat​\n\n","C:\\>standalone.bat start​\nWait for Milvus starting...​\nStart successfully.​\nTo change the default Milvus configuration, edit user.yaml and restart the service.​\n\n","# Stop Milvus​\nC:\\>standalone.bat stop​\nStop successfully.​\n​\n# Delete Milvus container​\nC:\\>standalone.bat delete​\nDelete Milvus container successfully. # Container has been removed.​\nDelete successfully. # Data has been removed.​\n\n","C:\\>wsl --install​\nUbuntu already installed.​\nStarting Ubuntu...​\n\n","# Download the installation script​\n$ curl -sfL https://raw.githubusercontent.com/milvus-io/milvus/master/scripts/standalone_embed.sh -o standalone_embed.sh​\n​\n# Start the Docker container​\n$ bash standalone_embed.sh start​\n\n","$ bash standalone_embed.sh start​\nWait for Milvus Starting...​\nStart successfully.​\nTo change the default Milvus configuration, add your settings to the user.yaml file and then restart the service.​\n\n","# Stop Milvus​\n$ bash standalone_embed.sh stop​\nStop successfully.​\n​\n# Delete Milvus data​\n$ bash standalone_embed.sh stop​\nDelete Milvus container successfully.​\nDelete successfully.​\n\n","# Download the configuration file and rename it as docker-compose.yml​\nC:\\>Invoke-WebRequest https://github.com/milvus-io/milvus/releases/download/v2.4.15/milvus-standalone-docker-compose.yml -OutFile docker-compose.yml​\n​\n# Start Milvus​\nC:\\>docker compose up -d​\nCreating milvus-etcd  ... done​\nCreating milvus-minio ... done​\nCreating milvus-standalone ... done​\n\n","C:\\>wsl --install​\nUbuntu already installed.​\nStarting Ubuntu...​\n\n","$ wget https://github.com/milvus-io/milvus/releases/download/v2.4.17/milvus-standalone-docker-compose.yml -O docker-compose.yml​\n\n","$ sudo docker compose up -d​\n​\nCreating milvus-etcd  ... done​\nCreating milvus-minio ... done​\nCreating milvus-standalone ... done​\n\n","C:\\>net start com.docker.service​\nThe Docker for Windows Service service is starting.​\nThe Docker for Windows Service service was started successfully.​\n\n","C:\\>wsl --update​\nChecking for updates.​\nThe most recent version of Windows Subsystem for Linux is already installed.​\n\n","C:\\>cd \"C:\\Program Files\\Docker\\Docker\"​\nC:\\Program Files\\Docker\\Docker>.\\DockerCli.exe -SwitchDaemon​\nSwitching to windows engine: Post \"http://ipc/engine/switch\": open \\\\.\\pipe\\dockerBackendApiServer: The system cannot find the file specified.​\n\n"],"headingContent":"Run Milvus in Docker (Windows)","anchorList":[{"label":"Run Milvus in Docker (Windows)","href":"Run-Milvus-in-Docker-Windows","type":1,"isActive":false},{"label":"Prerequisites​","href":"Prerequisites​","type":2,"isActive":false},{"label":"Run Milvus in Docker​","href":"Run-Milvus-in-Docker​","type":2,"isActive":false},{"label":"Run Milvus with Docker Compose​","href":"Run-Milvus-with-Docker-Compose​","type":2,"isActive":false},{"label":"FAQs​","href":"FAQs​","type":2,"isActive":false}]}
\ No newline at end of file
diff --git a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.md b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.md
index cccd01ea0..7c43ecd7d 100644
--- a/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.md
+++ b/localization/v2.5.x/site/en/getstarted/run-milvus-docker/install_standalone-windows.md
@@ -147,7 +147,7 @@ Delete successfully.​
 C:\>Invoke-WebRequest https://github.com/milvus-io/milvus/releases/download/v2.4.15/milvus-standalone-docker-compose.yml -OutFile docker-compose.yml​
 ​
 # Start Milvus​
-C:\>docker-compose up -d​
+C:\>docker compose up -d​
 Creating milvus-etcd  ... done​
 Creating milvus-minio ... done​
 Creating milvus-standalone ... done​
@@ -174,7 +174,7 @@ Starting Ubuntu...​
 
 

 
  • Start Milvus.​
    
-
    $ sudo docker-compose up -d​
+
    $ sudo docker compose up -d​
 ​
 Creating milvus-etcd  ... done​
 Creating milvus-minio ... done​
diff --git a/localization/v2.5.x/site/en/integrations/dify_with_milvus.json b/localization/v2.5.x/site/en/integrations/dify_with_milvus.json
index 4ba018473..a90de77d2 100644
--- a/localization/v2.5.x/site/en/integrations/dify_with_milvus.json
+++ b/localization/v2.5.x/site/en/integrations/dify_with_milvus.json
@@ -1 +1 @@
-{"codeList":["git clone https://github.com/langgenius/dify.git\n","cd dify/docker\n","cp .env.example .env\n","VECTOR_STORE=milvus\n","MILVUS_URI=xxx\nMILVUS_TOKEN=xxx\n","docker compose up -d\n","docker-compose up -d\n"],"headingContent":"Deploying Dify with Milvus","anchorList":[{"label":"Deploying Dify with Milvus","href":"Deploying-Dify-with-Milvus","type":1,"isActive":false},{"label":"Clone the Repository","href":"Clone-the-Repository","type":2,"isActive":false},{"label":"Set the Environment Variables","href":"Set-the-Environment-Variables","type":2,"isActive":false},{"label":"Start the Docker Containers","href":"Start-the-Docker-Containers","type":2,"isActive":false},{"label":"Log in to Dify","href":"Log-in-to-Dify","type":2,"isActive":false}]}
\ No newline at end of file
+{"codeList":["git clone https://github.com/langgenius/dify.git\n","cd dify/docker\n","cp .env.example .env\n","VECTOR_STORE=milvus\n","MILVUS_URI=xxx\nMILVUS_TOKEN=xxx\n","docker compose up -d\n","docker compose up -d\n"],"headingContent":"Deploying Dify with Milvus","anchorList":[{"label":"Deploying Dify with Milvus","href":"Deploying-Dify-with-Milvus","type":1,"isActive":false},{"label":"Clone the Repository","href":"Clone-the-Repository","type":2,"isActive":false},{"label":"Set the Environment Variables","href":"Set-the-Environment-Variables","type":2,"isActive":false},{"label":"Start the Docker Containers","href":"Start-the-Docker-Containers","type":2,"isActive":false},{"label":"Log in to Dify","href":"Log-in-to-Dify","type":2,"isActive":false}]}
\ No newline at end of file
diff --git a/localization/v2.5.x/site/en/integrations/dify_with_milvus.md b/localization/v2.5.x/site/en/integrations/dify_with_milvus.md
index d1daf33f3..d05c77a9a 100644
--- a/localization/v2.5.x/site/en/integrations/dify_with_milvus.md
+++ b/localization/v2.5.x/site/en/integrations/dify_with_milvus.md
@@ -90,7 +90,7 @@ MILVUS_TOKEN=xxx
 
    docker compose up -d
 
    
 
    If you have Docker Compose V1, use the following command:
    
-
    docker-compose up -d
+
    docker compose up -d
 
    
 
    Log in to Dify
    Execute in the same directory as docker-compose.yml. Ensure that the docker-compose version is ideally above 2.17, as some automation commands may not function otherwise.
    
 
    # Launch the container
-$ docker-compose up -d
+$ docker compose up -d
 # Wait for 10s, OneAPI typically needs to restart a few times to initially connect to Mysql
 $ sleep 10
 # Restart oneapi (Due to certain issues with the default Key of OneAPI, it will display 'channel not found' if not restarted, this can be temporarily resolved by manually restarting once, while waiting for the author's fix)
@@ -141,5 +141,5 @@ Click “Copy” on your token, ensuring that the value of this token matches th
         >
       
     
    Run the following command to stop the container.
    
-
    $ docker-compose down
+
    $ docker compose down
 
    
diff --git a/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.json b/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.json
index 94ddad105..00b239f06 100644
--- a/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.json
+++ b/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.json
@@ -1 +1 @@
-{"codeList":["$ git clone https://github.com/whyhow-ai/knowledge-table.git\n","$ docker-compose up -d --build\n","$ docker-compose down\n"],"headingContent":"Knowledge Table with Milvus","anchorList":[{"label":"Knowledge Table with Milvus","href":"Knowledge-Table-with-Milvus","type":1,"isActive":false},{"label":"Prerequisites","href":"Prerequisites","type":2,"isActive":false},{"label":"Cloning the project","href":"Cloning-the-project","type":2,"isActive":false},{"label":"Set up the environment","href":"Set-up-the-environment","type":2,"isActive":false},{"label":"Starting the app","href":"Starting-the-app","type":2,"isActive":false},{"label":"Stopping the app","href":"Stopping-the-app","type":2,"isActive":false},{"label":"Accessing the project","href":"Accessing-the-project","type":2,"isActive":false}]}
\ No newline at end of file
+{"codeList":["$ git clone https://github.com/whyhow-ai/knowledge-table.git\n","$ docker compose up -d --build\n","$ docker compose down\n"],"headingContent":"Knowledge Table with Milvus","anchorList":[{"label":"Knowledge Table with Milvus","href":"Knowledge-Table-with-Milvus","type":1,"isActive":false},{"label":"Prerequisites","href":"Prerequisites","type":2,"isActive":false},{"label":"Cloning the project","href":"Cloning-the-project","type":2,"isActive":false},{"label":"Set up the environment","href":"Set-up-the-environment","type":2,"isActive":false},{"label":"Starting the app","href":"Starting-the-app","type":2,"isActive":false},{"label":"Stopping the app","href":"Stopping-the-app","type":2,"isActive":false},{"label":"Accessing the project","href":"Accessing-the-project","type":2,"isActive":false}]}
\ No newline at end of file
diff --git a/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.md b/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.md
index 9a2eed566..cf38ed0da 100644
--- a/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.md
+++ b/localization/v2.5.x/site/en/integrations/knowledge_table_with_milvus.md
@@ -100,7 +100,7 @@ title: Knowledge Table with Milvus
           d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"
         >
       
-    
    $ docker-compose up -d --build
+    
    $ docker compose up -d --build
 
    
 
    Stopping the app
    $ docker-compose down
+    
    $ docker compose down
 
    
 
    Accessing the project
    
 
    For further details and more advanced setups, please refer to the DocsGPT official documentation.
    
diff --git a/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.json b/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.json
index bcf2fdcd5..0460396a8 100644
--- a/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.json
+++ b/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.json
@@ -1 +1 @@
-{"codeList":["git clone https://github.com/zilliztech/milvus-cdc.git\n\ncd milvus-cdc/server/configs\n","# cdc meta data config\nmetaStoreConfig:\n  # the metastore type, available value: etcd, mysql\n  storeType: etcd\n  # etcd address\n  etcdEndpoints:\n    - localhost:2379\n  # mysql connection address\n  # mysqlSourceUrl: root:root@tcp(127.0.0.1:3306)/milvus-cdc?charset=utf8\n  # meta data prefix, if multiple cdc services use the same store service, you can set different rootPaths to achieve multi-tenancy\n  rootPath: cdc\n","# milvus-source config, these settings are basically the same as the corresponding configuration of milvus.yaml in milvus source.\nsourceConfig:\n  # etcd config\n  etcdAddress:\n    - localhost:2379\n  etcdRootPath: by-dev\n  etcdMetaSubPath: meta\n  # default partition name\n  defaultPartitionName: _default\n  # read buffer length, mainly used for buffering if writing data to milvus-target is slow.\n  readChanLen: 10\n  replicateChan: by-dev-replicate-msg\n  # milvus-source mq config, which is pulsar or kafka\n  pulsar:\n    address: pulsar://localhost:6650\n    webAddress: localhost:80\n    maxMessageSize: 5242880\n    tenant: public\n    namespace: default\n#    authPlugin: org.apache.pulsar.client.impl.auth.AuthenticationToken\n#    authParams: token:xxx\n#  kafka:\n#    address: 127.0.0.1:9092\n","make build\n","bash build_image.sh\n","# dir tree\n.\n├── milvus-cdc # build from source code or download from release page\n├── configs\n│   └── cdc.yaml # config for cdc and source milvus\n\n# start milvus cdc\n./milvus-cdc server\n","docker-compose up -d\n"],"headingContent":"Deploy CDC Server","anchorList":[{"label":"Deploy CDC Server","href":"Deploy-CDC-Server","type":1,"isActive":false},{"label":"Prerequisites","href":"Prerequisites","type":2,"isActive":false},{"label":"Steps","href":"Steps","type":2,"isActive":false}]}
\ No newline at end of file
+{"codeList":["git clone https://github.com/zilliztech/milvus-cdc.git\n\ncd milvus-cdc/server/configs\n","# cdc meta data config\nmetaStoreConfig:\n  # the metastore type, available value: etcd, mysql\n  storeType: etcd\n  # etcd address\n  etcdEndpoints:\n    - localhost:2379\n  # mysql connection address\n  # mysqlSourceUrl: root:root@tcp(127.0.0.1:3306)/milvus-cdc?charset=utf8\n  # meta data prefix, if multiple cdc services use the same store service, you can set different rootPaths to achieve multi-tenancy\n  rootPath: cdc\n","# milvus-source config, these settings are basically the same as the corresponding configuration of milvus.yaml in milvus source.\nsourceConfig:\n  # etcd config\n  etcdAddress:\n    - localhost:2379\n  etcdRootPath: by-dev\n  etcdMetaSubPath: meta\n  # default partition name\n  defaultPartitionName: _default\n  # read buffer length, mainly used for buffering if writing data to milvus-target is slow.\n  readChanLen: 10\n  replicateChan: by-dev-replicate-msg\n  # milvus-source mq config, which is pulsar or kafka\n  pulsar:\n    address: pulsar://localhost:6650\n    webAddress: localhost:80\n    maxMessageSize: 5242880\n    tenant: public\n    namespace: default\n#    authPlugin: org.apache.pulsar.client.impl.auth.AuthenticationToken\n#    authParams: token:xxx\n#  kafka:\n#    address: 127.0.0.1:9092\n","make build\n","bash build_image.sh\n","# dir tree\n.\n├── milvus-cdc # build from source code or download from release page\n├── configs\n│   └── cdc.yaml # config for cdc and source milvus\n\n# start milvus cdc\n./milvus-cdc server\n","docker compose up -d\n"],"headingContent":"Deploy CDC Server","anchorList":[{"label":"Deploy CDC Server","href":"Deploy-CDC-Server","type":1,"isActive":false},{"label":"Prerequisites","href":"Prerequisites","type":2,"isActive":false},{"label":"Steps","href":"Steps","type":2,"isActive":false}]}
\ No newline at end of file
diff --git a/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.md b/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.md
index d2fc609c7..ff7885f11 100644
--- a/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.md
+++ b/localization/v2.5.x/site/en/userGuide/tools/milvus-cdc/deploy-cdc-server.md
@@ -149,6 +149,6 @@ sourceConfig:
 ./milvus-cdc server
 
    • 
 
  • Using Docker Compose:
    
-
    docker-compose up -d
+
    docker compose up -d
 
    •