Stores and encryption#

Hyvop keeps its state in PostgreSQL (core's database) and ClickHouse (the data lake of inventory, metrics and cost). This page extends Install, Backup and restore and Configuration in the Community guide.

Built-in or external#

The chart installs both stores by default (postgres.enabled and clickhouse.enabled, true). The chart's schema also has postgres.external.enabled and clickhouse.external.enabled, for a store you run yourself; they are listed in Configuration. With an external PostgreSQL, give postgres.db.core as the database name.

What is encrypted, and where#

• Secrets the database holds (what an integration signs in with, the mail relay's password, a model provider's key) are encrypted under the install's data key, which the chart makes and keeps in the Secret hyvop-core-secrets (data-key). Keep a copy of it with your backups: without it those secrets cannot be read.
• The stores' data is not encrypted by Hyvop. The stores hold your inventory, metrics, cost, findings and audit record in clear. Encrypt the volumes themselves with a storage class that encrypts (global.storageClass, or per store postgres.persistence.storageClass and clickhouse.persistence.storageClass).
• Core to the ingestors is always TLS, in every edition, with a certificate the chart issues from a private authority (internalTls.existingSecret brings your own).
• At the edge, the ingress serves plain HTTP by default. Turn on ingress.https, ingress.tls or ingress.certManager.clusterIssuer (Install, "HTTP and HTTPS").

Not covered#

Encryption in transit between core and the PostgreSQL or ClickHouse stores is not documented. Ask before you rely on it: see support.md.