pingcap / pingcap/tiup

Copy security.encryption.master-key.path file to each TiKV/PD servers

Open
#1,986 0 comments 1 reaction 1 assignee View on GitHub

@qqqdan is already working on this.

Since Jul 18, 2022.

type/feature-request
Dominant language
Go
Stars
466
Forks
338
Avg merge
3d 7h
Merged PRs (30d)
8

Description

Feature Request

To configure Encryption at Rest feature, we need to copy the master key in advance to each TiKV/PD servers manually using scp.

Why the featue is needed:
It would be very helpful if tiup can copy the master key to each TiKV/PD servers based on the security.encryption.master-key.path setting to make the setup easier.

Describe alternatives you've considered:
So far we can copy the master file using scp. At least it requires to copy the file 6 times, 3 for PD and 3 for TiKV.

Teachability, Documentation, Adoption, Migration Strategy:

'

Here is the sample yaml file.

pd_servers:
  - host: <PD#1>
    config:
      security.encryption.data-encryption-method: "aes128-ctr"
      security.encryption.data-key-rotation-period: "6h"
      security.encryption.master-key.type: "file"
      security.encryption.master-key.path: "/tmp/tidb-master-key"
  - host: <PD#2>
    config:
      security.encryption.data-encryption-method: "aes128-ctr"
      security.encryption.data-key-rotation-period: "6h"
      security.encryption.master-key.type: "file"
      security.encryption.master-key.path: "/tmp/tidb-master-key"
  - host: <PD#3>
    config:
      security.encryption.data-encryption-method: "aes128-ctr"
      security.encryption.data-key-rotation-period: "6h"
      security.encryption.master-key.type: "file"
      security.encryption.master-key.path: "/tmp/tidb-master-key"

tikv_servers:
  - host: <TiKV#1>
    config:
      security.encryption.data-encryption-method: "aes128-ctr"
      security.encryption.data-key-rotation-period: "6h"
      security.encryption.master-key.type: "file"
      security.encryption.master-key.path: "/tmp/tidb-master-key"
  - host: <TiKV#2>
    config:
      security.encryption.data-encryption-method: "aes128-ctr"
      security.encryption.data-key-rotation-period: "6h"
      security.encryption.master-key.type: "file"
      security.encryption.master-key.path: "/tmp/tidb-master-key"
  - host: <TiKV#3>
    config:
      security.encryption.data-encryption-method: "aes128-ctr"
      security.encryption.data-key-rotation-period: "6h"
      security.encryption.master-key.type: "file"
      security.encryption.master-key.path: "/tmp/tidb-master-key"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.