Add post-installation config section for ML-KEM KRA

[ladycfu]

• Document ML-KEM wrapping.2 configuration differences
• Add recommended security settings (AES-KWP for PKCS#12)
• Note that ML-KEM doesn't support kra.allowEncDecrypt.archival

Summary by CodeRabbit

• Documentation
  • Added post-installation guidance for configuring ML-KEM after KRA installation.
  • Documented ML-KEM wrapping behavior and unsupported archival encryption and decryption.
  • Added recommendations for PKCS#12 AES-256-KWP settings and noted the required instance restart.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b6c3fd60-0a4a-4617-b4b6-d9a4f92a03f9

📥 Commits

Reviewing files that changed from the base of the PR and between 4c9c625 and 2e90fa4.

📒 Files selected for processing (1)

• docs/installation/kra/installing-kra-with-pqc.adoc

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/installation/kra/installing-kra-with-pqc.adoc

---

📝 Walkthrough

Walkthrough

The KRA installation guide adds ML-KEM configuration references and post-installation instructions. The instructions cover archival encryption limits, AES-256-KWP PKCS#12 settings, and required KRA instance restarts.

Changes

KRA ML-KEM guidance

Layer / File(s)	Summary
ML-KEM post-installation guidance docs/installation/kra/installing-kra-with-pqc.adoc	The guide links to ML-KEM configuration and security settings. It documents unsupported archival encryption, recommended AES-256-KWP PKCS#12 settings, and the required instance restart.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the added post-installation ML-KEM KRA configuration section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

docs/installation/kra/installing-kra-with-pqc.adoc (1)

125-130: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Document active ML-KEM wrapping selection.

wrapping.2 in CS.cfg is inactive unless kra.storageUnit.wrapping.choice=2 is set. The deployed KRA uses choice=2, and the shared template still contains choice=1; say that pkispawn sets choice=2 for PQC KRA installs so this section is clear.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/installation/kra/installing-kra-with-pqc.adoc` around lines 125 - 130,
Update the ML-KEM KRA installation documentation near the wrapping.2
configuration description to state that pkispawn sets
kra.storageUnit.wrapping.choice=2 for PQC KRA installations, activating
wrapping.2. Clarify that the shared template may still contain choice=1.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/installation/kra/installing-kra-with-pqc.adoc`:
- Around line 125-130: Update the ML-KEM KRA installation documentation near the
wrapping.2 configuration description to state that pkispawn sets
kra.storageUnit.wrapping.choice=2 for PQC KRA installations, activating
wrapping.2. Clarify that the shared template may still contain choice=1.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e38cafeb-03c2-47ba-91f7-117da7ae79f5

📥 Commits

Reviewing files that changed from the base of the PR and between 2a7cc39 and b5f962c.

📒 Files selected for processing (1)

• docs/installation/kra/installing-kra-with-pqc.adoc

[fmarco76]

LGTM. I have a comment for the latest command but feel free to update/merge.

[fmarco76]

Instance name could be different from pki-tomcat. Should this be:

$ systemctl restart pki-tomcatd@<pki_instance_name>.service

Alternatively, we have internal command:

pki-server restart [OPTIONS] [<instance ID>]

If instance is not provided default is used.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[ladycfu]

Thanks @fmarco76 !