cockroachdb / cockroachdb/cockroach

cli,storage: cockroach debug range-data command does not work on encrypted checkpoints

Open
#142,267 2 comments 0 reactions 0 assignees View on GitHub
A-storage branch-master branch-release-23.2 branch-release-24.1 branch-release-24.2 branch-release-24.3 branch-release-25.1 C-bug T-storage
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

When the consistency checker encounters replica divergence, it creates checkpoints on the relevant replicas and notifies the user to contact support. The first step in debugging such divergence is to use the `range-data` command and the `diff` utility to identify the data that has diverged.

Unfortunately, a checkpoint of an encrypted store does not contains enough information for the range-data command to operate on it directly (even if the user specifies the keys).

There are a couple of problems:

1. The checkpoint does not contain `COCKROACHDB_REGISTRY` and `COCKROACHDB_DATA_KEYS*` files required to decrypt the files.
2. The main store does contain such files, but the registry refers to all checkpointed files via their "pre-rename" names in an `_pending` directory.

As a result, the `range-data` command works on encrypted _store_ directories, but not on a checkpoint of that store.

Jira issue: CRDB-48255

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.