Add db-encryption Support

charts/portainer/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 1.0.22
+version: 1.0.23
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.

charts/portainer/templates/deployment.yaml

@@ -33,6 +33,11 @@ spec:
           secret:
             secretName: {{ .Values.tls.existingSecret }}
         {{- end }}
+        {{- if .Values.dbEncryption.enabled }}
+        - name: db-encryption-key
+          secret:
+            secretName: {{ .Values.dbEncryption.secret }}
+        {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           {{- if .Values.enterpriseEdition.enabled }}
@@ -64,6 +69,11 @@ spec:
               mountPath: /certs
               readOnly: true
             {{- end }}
+            {{- if .Values.dbEncryption.enabled }}
+            - name: db-encryption-key
+              mountPath: "/run/secrets/portainer"
+              subPath: portainer
+            {{- end }}
           ports:
             {{- if not .Values.tls.force }}
             - name: http

charts/portainer/values.yaml

@@ -47,6 +47,13 @@ tls:
 feature:
   flags: ""
 
+dbEncryption:
+  # If set, Portainer will encrypt the database
+  enabled: false
+  # If enabled, the following secret will be mounted into the pod for the database encryption
+  # Ensure to pre-create the secret in the cluster
+  secret: ""
+
 ingress:
   enabled: false
   ingressClassName: ""