Applying PR 309 to v5.5/v5.4

versioned_docs/version-5.4/02.deploying/05.docker/05.docker.md

@@ -38,6 +38,7 @@ allinone:
     environment:
         - CLUSTER_JOIN_ADDR=node_ip
         - NV_PLATFORM_INFO=platform=Docker
+        - STORE_PASSPHRASE_FILE=/run/secrets/nv_store_passphrase
     ports:
         - 18300:18300
         - 18301:18301
@@ -51,10 +52,20 @@ allinone:
         - /var/run/docker.sock:/var/run/docker.sock:ro
         - /proc:/host/proc:ro
         - /sys/fs/cgroup:/host/cgroup:ro
+        - /path/on/host/store_passphrase:/run/secrets/nv_store_passphrase:ro
 ```
 
 The most important environment variable is the **CLUSTER_JOIN_ADDR**. It is the IP address that other enforcers connect to. Normally, it should be set to the IP address of the node where all-in-one container is running.
 
+**STORE_PASSPHRASE_FILE** (required as of NeuVector v5.6.2+) points to a file containing the passphrase used for state encryption. Non-Kubernetes deployments have no automatic equivalent of the Kubernetes-managed encryption secret, so this must be provided explicitly, or the controller will fail to start. Generate one with:
+
+```shell
+openssl rand -base64 48 > /path/on/host/store_passphrase
+chmod 600 /path/on/host/store_passphrase
+```
+
+Back this file up separately from /var/neuvector — it is a master key for encrypted state, and losing it may prevent decrypting persisted configuration.
+
 Port 18300 and 18301 are default ports for cluster communication. They must be identical for all controllers and enforcers in the cluster. Please refer to *"Docker-compose Details"* section for how to change the default ports.
 
 Note: To expose the REST API in the Allinone, add the port map for 10443, for example - 10443:10443.

versioned_docs/version-5.5/02.deploying/05.docker/05.docker.md

@@ -38,6 +38,7 @@ allinone:
     environment:
         - CLUSTER_JOIN_ADDR=node_ip
         - NV_PLATFORM_INFO=platform=Docker
+        - STORE_PASSPHRASE_FILE=/run/secrets/nv_store_passphrase
     ports:
         - 18300:18300
         - 18301:18301
@@ -51,10 +52,20 @@ allinone:
         - /var/run/docker.sock:/var/run/docker.sock:ro
         - /proc:/host/proc:ro
         - /sys/fs/cgroup:/host/cgroup:ro
+        - /path/on/host/store_passphrase:/run/secrets/nv_store_passphrase:ro
 ```
 
 The most important environment variable is the **CLUSTER_JOIN_ADDR**. It is the IP address that other enforcers connect to. Normally, it should be set to the IP address of the node where all-in-one container is running.
 
+**STORE_PASSPHRASE_FILE** (required as of NeuVector v5.6.2+) points to a file containing the passphrase used for state encryption. Non-Kubernetes deployments have no automatic equivalent of the Kubernetes-managed encryption secret, so this must be provided explicitly, or the controller will fail to start. Generate one with:
+
+```shell
+openssl rand -base64 48 > /path/on/host/store_passphrase
+chmod 600 /path/on/host/store_passphrase
+```
+
+Back this file up separately from /var/neuvector — it is a master key for encrypted state, and losing it may prevent decrypting persisted configuration.
+
 Port 18300 and 18301 are default ports for cluster communication. They must be identical for all controllers and enforcers in the cluster. Please refer to *"Docker-compose Details"* section for how to change the default ports.
 
 Note: To expose the REST API in the Allinone, add the port map for 10443, for example - 10443:10443.