Skip to content

Commit 7d77bef

Browse files
committed
AUTO: Sync Helm Charts docs to ScalarDB Enterprise docs site repo
1 parent 8121bac commit 7d77bef

File tree

1 file changed

+43
-0
lines changed

1 file changed

+43
-0
lines changed

versioned_docs/version-3.10/helm-charts/configure-custom-values-scalardb-cluster.mdx

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -373,3 +373,46 @@ scalardbCluster:
373373
operator: Equal
374374
value: scalardb-cluster
375375
```
376+
377+
### Encryption configurations (optional based on your environment)
378+
379+
You can enable [encryption at rest](https://scalardb.scalar-labs.com/docs/latest/scalardb-cluster/encrypt-data-at-rest/) to protect the data in the backend databases. When you use the encryption feature, you have the following two deployment options:
380+
381+
1. Use HashiCorp Vault (HashiCorp Cloud Platform (HCP) Vault Dedicated) to manage and store the DEKs.
382+
1. Use ScalarDB Cluster to manage the DEK, and store it in Kubernetes Secrets.
383+
384+
#### Use HashiCorp Vault
385+
386+
You can use HashiCorp Vault (HCP Vault Dedicated) to encrypt data as follows, replacing the contents in the angle brackets as described:
387+
388+
```yaml
389+
scalardbCluster:
390+
scalardbClusterNodeProperties: |
391+
...(omit)...
392+
scalar.db.cluster.encryption.enabled=true
393+
scalar.db.cluster.encryption.type=vault
394+
scalar.db.cluster.encryption.vault.address=https://<FQDN_OR_IP_OF_VAULT_SERVER>:<PORT_OF_VAULT_SERVER>
395+
scalar.db.cluster.encryption.vault.token=<TOKEN_OF_VAULT>
396+
scalar.db.cluster.encryption.vault.transit_secrets_engine_path=<PATH_TO_TRANSIT_OF_VAULT>
397+
encryption:
398+
enabled: true
399+
type: "vault"
400+
```
401+
402+
#### Use ScalarDB Cluster and Kubernetes Secrets
403+
404+
You can use ScalarDB Cluster and Kubernetes Secrets to encrypt data as follows, replacing the contents in the angle brackets as described:
405+
406+
```yaml
407+
scalardbCluster:
408+
scalardbClusterNodeProperties: |
409+
...(omit)...
410+
scalar.db.cluster.encryption.enabled=true
411+
scalar.db.cluster.encryption.type=self
412+
scalar.db.cluster.encryption.self.kubernetes.secret.namespace_name=${env:SCALAR_DB_CLUSTER_ENCRYPTION_SELF_KUBERNETES_SECRET_NAMESPACE_NAME}
413+
encryption:
414+
enabled: true
415+
type: "self"
416+
```
417+
418+
In this case, you don't need to replace `${env:SCALAR_DB_CLUSTER_ENCRYPTION_SELF_KUBERNETES_SECRET_NAMESPACE_NAME}` since the Helm Chart for ScalarDB Cluster automatically sets the namespace information as an environment variable. Because of this, you can keep the value `${env:SCALAR_DB_CLUSTER_ENCRYPTION_SELF_KUBERNETES_SECRET_NAMESPACE_NAME}` as is.

0 commit comments

Comments
 (0)