Secure Your Nacos Configs: How to Store Encrypted Data in Nacos 2.1.0

How to Configure Encrypted Storage in Nacos 2.1.0

To protect sensitive configuration data, Nacos provides a new encryption feature that reduces risk and eliminates the need for separate encryption handling.

When the Nacos server starts, it loads all supported encryption algorithms and matches configurations by the dataId prefix to determine whether encryption is required and which algorithm to use.

Configurations published by clients are encrypted on the client side via a filter, ensuring ciphertext in transit, while configurations published through the console are processed on the server side.

How to Use

① Add Encryption Plugin to Nacos Server

ASE plugin

<code>&lt;dependency&gt;
    &lt;groupId&gt;com.alibaba.nacos&lt;/groupId&gt;
    &lt;artifactId&gt;nacos-aes-encryption-plugin&lt;/artifactId&gt;
    &lt;version&gt;${nacos-aes-encryption-plugin.version}&lt;/version&gt;
&lt;/dependency&gt;
</code>

SM4 national encryption plugin

<code>&lt;dependency&gt;
    &lt;groupId&gt;io.springboot.nacos&lt;/groupId&gt;
    &lt;artifactId&gt;nacos-encryption-plugin-ext&lt;/artifactId&gt;
    &lt;version&gt;0.0.1&lt;/version&gt;
&lt;/dependency&gt;
</code>

Server addition

nacos add encryption plugin

② Add Configuration

Use a configuration prefix of

cipher-[encryption-algorithm]-dataId

to indicate that the entry must be encrypted; the system will automatically encrypt it. For example, using the SM4 algorithm:

<code>cipher-sm4-pig-upms-biz-dev.yml</code>

Reference [1]

Reference Materials

[1] Reference: https://nacos.io/zh-cn/docs/config-encryption.html