feat: allow configuring data_encryption keys (#622)
diff --git a/charts/apisix/README.md b/charts/apisix/README.md
index 5889269..4738c1f 100644
--- a/charts/apisix/README.md
+++ b/charts/apisix/README.md
@@ -59,6 +59,8 @@
| apisix.affinity | object | `{}` | Set affinity for Apache APISIX deploy |
| apisix.customLuaSharedDicts | list | `[]` | Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module#toc88) settings, click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict |
| apisix.customizedConfig | object | `{}` | If apisix.enableCustomizedConfig is true, full customized config.yaml. Please note that other settings about APISIX config will be ignored |
+| apisix.data_encryption | object | `{"enabled":false,"keyring":[]}` | Enable Data Encryption |
+| apisix.data_encryption.keyring | list | `[]` | An array of 16 character strings used to encrypt/decrypt fields with AES-128-CBC |
| apisix.enableCustomizedConfig | bool | `false` | Enable full customized config.yaml |
| apisix.enableIPv6 | bool | `true` | Enable nginx IPv6 resolver |
| apisix.enableServerTokens | bool | `true` | Whether the APISIX version number should be shown in Server header |
diff --git a/charts/apisix/templates/configmap.yaml b/charts/apisix/templates/configmap.yaml
index ebe0b5c..87f1064 100644
--- a/charts/apisix/templates/configmap.yaml
+++ b/charts/apisix/templates/configmap.yaml
@@ -165,6 +165,15 @@
fallback_sni: {{ .Values.gateway.tls.fallbackSNI | quote }}
{{- end }}
+ {{- if .Values.apisix.data_encryption.enabled }}
+ data_encryption:
+ enable: true
+ keyring:
+ {{- range .Values.apisix.data_encryption.keyring }}
+ - {{ . }}
+ {{ end }}
+ {{- end }}
+
nginx_config: # config for render the template to genarate nginx.conf
error_log: "{{ .Values.logs.errorLog }}"
error_log_level: "{{ .Values.logs.errorLogLevel }}" # warn,error
diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml
index 4b1ed94..c4c2660 100644
--- a/charts/apisix/values.yaml
+++ b/charts/apisix/values.yaml
@@ -86,6 +86,12 @@
# -- Enable the proxy protocol to the upstream server
upstream: true
+ # -- Enable Data Encryption
+ data_encryption:
+ enabled: false
+ # -- An array of 16 character strings used to encrypt/decrypt fields with AES-128-CBC
+ keyring: []
+
# -- Enable full customized config.yaml
enableCustomizedConfig: false
# -- If apisix.enableCustomizedConfig is true, full customized config.yaml.
