# Encrypting sensitive data

You can encrypt any Sonar property stored in the `values.yaml` file and some Helm parameters, such as `jdbcPassword`, that will be managed as sonar properties. The encryption algorithm used is AES with 256-bit keys.

You must have the Administer System permission in SonarQube Server to perform this procedure.

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

SonarQube Server must be up and running.

## Step 1: Create the encryption key <a href="#create-encryption-key" id="create-encryption-key"></a>

<figure><img src="https://2744305742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3VWSqvZ4eaBLWvA6epdv%2Fuploads%2FfoGxwCUKVXFZ0K47uZrO%2Fencryption%20(1).png?alt=media&#x26;token=0268e023-4d8f-4e69-a3ac-f525e27f1da7" alt="Generating an encryption key"><figcaption></figcaption></figure>

1. Go to **Administration > Configuration > Encryption**.
2. Select **Generate Secret Key**. An encryption key is generated.
3. Store the generated key in a safe location.

## Step 2: Create a Kubernetes secret to store the encryption key <a href="#create-kubernetes-secret" id="create-kubernetes-secret"></a>

Use the command below:

```sh
kubectl create secret generic --from-literal sonar-secret.txt=<encryptionKeyValue> <encryptionKeySecretName>
```

Example:

```sh
kubectl create secret generic --from-literal sonar-secret.txt=EgycYJc4Ek4uj2pH39e3+bnnk15IrVu4dxtfjDyN1y8= myEncryptionKeySecret
```

## Step 3: Enable the encryption in the Helm chart <a href="#enable-encryption-in-chart" id="enable-encryption-in-chart"></a>

Install the encryption key secret as follows:

1\. Add the following to the `values.yaml` file:

```yaml
sonarSecretKey: <encryptionKeySecretName>
```

2\. Use the helm upgrade command.

## Step 4: Encrypt the sensitive data <a href="#encrypt-data" id="encrypt-data"></a>

To encrypt a sensitive property in `values.yaml`:

1\. Go to **Administration > Configuration > Encryption**.

2\. Enter the value of the property.

3\. Select the **Encrypt** button. The encrypted value of the property is generated.

4\. Select the copy tool.

5\. In the `values.yaml` file, replace the value of the property with the copied encrypted value.

6\. Use the helm upgrade command.