README: SQLite specify encryption limitations

rancher · Aug 30, 2024 · ffb01f6 · ffb01f6
1 parent ea6c83b
commit ffb01f6
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -61,6 +61,14 @@ Steve is used with SQLite caching of resources, which is configured when
 calling `server.New` via the `server.Options.SQLCache` boolean option.
 Meaning and behavior are the same unless otherwise specified.
 
+Note that, if SQLite caching of resources is enabled, some of the data
+is encrypted at rest. In particular:
+ - by default, Secrets are encrypted
+ - if the environment variable `CATTLE_ENCRYPT_CACHE_ALL` is set to "true",
+all resources are encrypted
+ - regardless of the setting, any filterable/sortable columns are stored
+in plain text (see `filter` below for the exact list)
+
 #### `limit`
 
 **If SQLite caching is disabled** (`server.Options.SQLCache=false`),