Document/Show a pattern on how to store sensitive data in the database

[machi1990]

Description

Some fleet managers may need to store sensitive data. The current template is missing a pattern of how this can be done. Even though encryption at rest can be turned on for some database vendors, it is good to add another layer of protection applicative wise. Some ideas that are current being discussed:

• encrypt and decrypt data using the db encryption functions e.g pgcrypto
• use a dedicated service like Vault to store sensitive data and only store the ref/vault key in the database. The same pattern like https://github.com/bf2fc6cc711aee1a0c2a/kas-fleet-manager/tree/main/internal/connector/internal/services/vault

Analysis

We need to investigate on the best pattern by doing further analysis

• perf overhead
• some other protection mechanism
• etc

Task List