From 37be8647727ec493f3e849bf4a3ec9d9196cd803 Mon Sep 17 00:00:00 2001
From: "xiaolong.ran" <rxl@apache.org>
Date: Fri, 20 Nov 2020 22:57:15 +0800
Subject: [PATCH 1/2] Add e2e docs for pulsar functions

Signed-off-by: xiaolong.ran <rxl@apache.org>
---
 site2/docs/functions-worker.md       | 8 ++++++++
 site2/docs/io-cli.md                 | 2 ++
 site2/docs/reference-pulsar-admin.md | 3 +++
 3 files changed, 13 insertions(+)

diff --git a/site2/docs/functions-worker.md b/site2/docs/functions-worker.md
index 797078252087a..8a5f1e95aa13f 100644
--- a/site2/docs/functions-worker.md
+++ b/site2/docs/functions-worker.md
@@ -99,6 +99,7 @@ If you want to enable security on functions workers, you *should*:
 - [Enable TLS transport encryption](#enable-tls-transport-encryption)
 - [Enable Authentication Provider](#enable-authentication-provider)
 - [Enable Authorization Provider](#enable-authorization-provider)
+- [Enable End-to-End Encryption](#enable-end-to-end-encryption)
 
 ##### Enable TLS transport encryption
 
@@ -180,6 +181,13 @@ superUserRoles:
   - role3
 ```
 
+##### Enable End-to-End Encryption
+
+You can use the public and private key pair that the application configures to perform encryption. Only the consumers with a valid key can decrypt the encrypted messages.
+
+To enable End-to-End encryption on Functions Worker, you can set it by specifying `--producer-config` in the command line terminal, for more information, please refer to [here](security-encryption.md).
+
+
 #### BookKeeper Authentication
 
 If authentication is enabled on the BookKeeper cluster, you need configure the BookKeeper authentication settings as follows:
diff --git a/site2/docs/io-cli.md b/site2/docs/io-cli.md
index a1ecc2a459a45..806bcdab0472f 100644
--- a/site2/docs/io-cli.md
+++ b/site2/docs/io-cli.md
@@ -71,6 +71,7 @@ $ pulsar-admin sources create options
 | `--source-config-file` | The path to a YAML config file specifying the source's configuration.
 | `-t`, `--source-type` | The source's connector provider.
 | `--tenant` | The source's tenant.
+|`--producer-config`| The custom producer configuration (as a JSON string).
 
 ### `update`
 
@@ -273,6 +274,7 @@ $ pulsar-admin sources localrun options
 |`--tls-allow-insecure`|Allow insecure tls connection.<br>**Default value: false**.
 |`--tls-trust-cert-path`|The tls trust cert file path.
 |`--use-tls`|Use tls connection.<br>**Default value: false**.
+|`--producer-config`| The custom producer configuration (as a JSON string).
 
 ### `available-sources`
 
diff --git a/site2/docs/reference-pulsar-admin.md b/site2/docs/reference-pulsar-admin.md
index 18bfce62e6dbb..8a75c22c836fe 100644
--- a/site2/docs/reference-pulsar-admin.md
+++ b/site2/docs/reference-pulsar-admin.md
@@ -464,6 +464,7 @@ Options
 |`--tls-allow-insecure`|Allow insecure tls connection|false|
 |`--tls-trust-cert-path`|The tls trust cert file path||
 |`--use-tls`|Use tls connection|false|
+|`--producer-config`| The custom producer configuration (as a JSON string) | |
 
 
 ### `create`
@@ -509,6 +510,7 @@ Options
 |`--max-message-retries`|How many times should we try to process a message before giving up||
 |`--retain-ordering`|Function consumes and processes messages in order||
 |`--timeout-ms`|The message timeout in milliseconds||
+|`--producer-config`| The custom producer configuration (as a JSON string) | |
 
 
 ### `delete`
@@ -572,6 +574,7 @@ Options
 |`--max-message-retries`|How many times should we try to process a message before giving up||
 |`--retain-ordering`|Function consumes and processes messages in order||
 |`--timeout-ms`|The message timeout in milliseconds||
+|`--producer-config`| The custom producer configuration (as a JSON string) | |
 
 
 ### `get`

From 8f987299da2e4729ecd4d6b4f4618af690da2b73 Mon Sep 17 00:00:00 2001
From: "xiaolong.ran" <rxl@apache.org>
Date: Fri, 20 Nov 2020 23:28:58 +0800
Subject: [PATCH 2/2] add content

Signed-off-by: xiaolong.ran <rxl@apache.org>
---
 site2/docs/functions-worker.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/site2/docs/functions-worker.md b/site2/docs/functions-worker.md
index 8a5f1e95aa13f..10fc85bc9c6de 100644
--- a/site2/docs/functions-worker.md
+++ b/site2/docs/functions-worker.md
@@ -187,6 +187,22 @@ You can use the public and private key pair that the application configures to p
 
 To enable End-to-End encryption on Functions Worker, you can set it by specifying `--producer-config` in the command line terminal, for more information, please refer to [here](security-encryption.md).
 
+We include the relevant configuration information of `CryptoConfig` into `ProducerConfig`. The specific configurable field information about `CryptoConfig` is as follows:
+
+```text
+public class CryptoConfig {
+    private String cryptoKeyReaderClassName;
+    private Map<String, Object> cryptoKeyReaderConfig;
+
+    private String[] encryptionKeys;
+    private ProducerCryptoFailureAction producerCryptoFailureAction;
+
+    private ConsumerCryptoFailureAction consumerCryptoFailureAction;
+}
+```
+
+- `producerCryptoFailureAction`: define the action if producer fail to encrypt data one of `FAIL`, `SEND`.
+- `consumerCryptoFailureAction`: define the action if consumer fail to decrypt data one of `FAIL`, `DISCARD`, `CONSUME`.
 
 #### BookKeeper Authentication