IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Add concept about envelope encryption (#41860)

Browse Source 
* Add concept about envelope-encryption.

* remove comma

* separate warning note into steps

* remove steps from warning note

* Fix lint

Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com>
Co-authored-by: Dominik Prokop <dominik.prokop@grafana.com>
This commit is contained in:
Ursula Kallio 2021-11-19 15:51:16 +01:00 committed by GitHub
parent f5641c0293
commit ed0f3100b3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
docs/sources/administration/envelope-encryption.md Normal file
View File

@ -0,0 +1,19 @@
+++
title = "Envelope encryption"
description = "Envelope encryption"
keywords = ["grafana", "envelope encryption", "documentation"]
aliases = [""]
weight = 430
+++
# Envelope encryption
In Grafana, you can choose to use envelope encryption. Instead of
encrypting all secrets with a single key, Grafana uses a set of keys
called data encryption keys (DEKs) to encrypt them. These data
encryption keys are themselves encrypted with a single key encryption
key (KEK).
To turn on envelope encryption, add the term `envelopeEncryption` to the list of feature toggles in your [Grafana configuration]({{< relref "../administration/configuration/#feature_toggles" >}}).
**> Note:** Avoid turning off envelope encryption once you have turned it on, and back up your database before turning it on for the first time. If you turn envelope encryption on, create new secrets or update your existing secrets (for example, by creating a new data source or alert notification channel), and then turn envelope encryption off, then those data sources, alert notification channels, and other resources using envelope encryption will stop working and you will experience errors. This is because the secrets encrypted with envelope encryption cannot be decrypted or used by Grafana when envelope encryption is turned off.