Kong / Kong/developer.konghq.com

LMDB encryption is not supported through kong.conf

Open
#2,418 0 comments 0 reactions 0 assignees View on GitHub
bug bug-bash feedback internal product:gateway
Dominant language
Ruby
Stars
28
Forks
121
Avg merge
1d 4h
Merged PRs (30d)
313

Description

From Slack:

> On this [page](https://developer.konghq.com/gateway/hybrid-mode/#data-plane-cache-configuration) we have "If encrypted, the Data Plane uses the cluster certificate key to decrypt the LMDB database on startup."
I believe doing this through Kong ( declarative_config_encryption_mode) is no longer supported & has to be done by the underlying infra (e.g disk encryption).

We [removed support for LMDB encryption in 3.4](https://developer.konghq.com/gateway/changelog/#3-4-0-0-breaking-change):

> LMDB encryption has been disabled. The option declarative_config_encryption_mode has been removed from kong.conf.

We need to remove all references to encrypting the lmbd from https://developer.konghq.com/gateway/hybrid-mode/#data-plane-cache-configuration, and any other places if they exist.

Need to double check if there's some other way to encrypt it, now that the kong-native method isn't available, or if we don't want to tell people to do that.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the Data Plane cache configuration section at the hybrid-mode documentation URL and compare its encryption guidance with the 3.4.0.0 breaking-change entry. Search the documentation for other references to LMDB encryption or declarative_config_encryption_mode, then confirm what guidance remains valid. Done means outdated Kong-native encryption references are removed or corrected without suggesting an unsupported approach.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.