From 92bc4c74b2e4fb7696fa5cb0e4137fe7164e7e28 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Fri, 18 Sep 2026 10:04:01 -0700 Subject: [PATCH] Applying PR 309 to v5.5/v5.4 Signed-off-by: Sunil Singh --- .../version-5.4/02.deploying/05.docker/05.docker.md | 11 +++++++++++ .../version-5.5/02.deploying/05.docker/05.docker.md | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/versioned_docs/version-5.4/02.deploying/05.docker/05.docker.md b/versioned_docs/version-5.4/02.deploying/05.docker/05.docker.md index a3948e8f7..92a9dec89 100644 --- a/versioned_docs/version-5.4/02.deploying/05.docker/05.docker.md +++ b/versioned_docs/version-5.4/02.deploying/05.docker/05.docker.md @@ -38,6 +38,7 @@ allinone: environment: - CLUSTER_JOIN_ADDR=node_ip - NV_PLATFORM_INFO=platform=Docker + - STORE_PASSPHRASE_FILE=/run/secrets/nv_store_passphrase ports: - 18300:18300 - 18301:18301 @@ -51,10 +52,20 @@ allinone: - /var/run/docker.sock:/var/run/docker.sock:ro - /proc:/host/proc:ro - /sys/fs/cgroup:/host/cgroup:ro + - /path/on/host/store_passphrase:/run/secrets/nv_store_passphrase:ro ``` The most important environment variable is the **CLUSTER_JOIN_ADDR**. It is the IP address that other enforcers connect to. Normally, it should be set to the IP address of the node where all-in-one container is running. +**STORE_PASSPHRASE_FILE** (required as of NeuVector v5.6.2+) points to a file containing the passphrase used for state encryption. Non-Kubernetes deployments have no automatic equivalent of the Kubernetes-managed encryption secret, so this must be provided explicitly, or the controller will fail to start. Generate one with: + +```shell +openssl rand -base64 48 > /path/on/host/store_passphrase +chmod 600 /path/on/host/store_passphrase +``` + +Back this file up separately from /var/neuvector — it is a master key for encrypted state, and losing it may prevent decrypting persisted configuration. + Port 18300 and 18301 are default ports for cluster communication. They must be identical for all controllers and enforcers in the cluster. Please refer to *"Docker-compose Details"* section for how to change the default ports. Note: To expose the REST API in the Allinone, add the port map for 10443, for example - 10443:10443. diff --git a/versioned_docs/version-5.5/02.deploying/05.docker/05.docker.md b/versioned_docs/version-5.5/02.deploying/05.docker/05.docker.md index a3948e8f7..92a9dec89 100644 --- a/versioned_docs/version-5.5/02.deploying/05.docker/05.docker.md +++ b/versioned_docs/version-5.5/02.deploying/05.docker/05.docker.md @@ -38,6 +38,7 @@ allinone: environment: - CLUSTER_JOIN_ADDR=node_ip - NV_PLATFORM_INFO=platform=Docker + - STORE_PASSPHRASE_FILE=/run/secrets/nv_store_passphrase ports: - 18300:18300 - 18301:18301 @@ -51,10 +52,20 @@ allinone: - /var/run/docker.sock:/var/run/docker.sock:ro - /proc:/host/proc:ro - /sys/fs/cgroup:/host/cgroup:ro + - /path/on/host/store_passphrase:/run/secrets/nv_store_passphrase:ro ``` The most important environment variable is the **CLUSTER_JOIN_ADDR**. It is the IP address that other enforcers connect to. Normally, it should be set to the IP address of the node where all-in-one container is running. +**STORE_PASSPHRASE_FILE** (required as of NeuVector v5.6.2+) points to a file containing the passphrase used for state encryption. Non-Kubernetes deployments have no automatic equivalent of the Kubernetes-managed encryption secret, so this must be provided explicitly, or the controller will fail to start. Generate one with: + +```shell +openssl rand -base64 48 > /path/on/host/store_passphrase +chmod 600 /path/on/host/store_passphrase +``` + +Back this file up separately from /var/neuvector — it is a master key for encrypted state, and losing it may prevent decrypting persisted configuration. + Port 18300 and 18301 are default ports for cluster communication. They must be identical for all controllers and enforcers in the cluster. Please refer to *"Docker-compose Details"* section for how to change the default ports. Note: To expose the REST API in the Allinone, add the port map for 10443, for example - 10443:10443.