Copy security.encryption.master-key.path file to each TiKV/PD servers
Open
@qqqdan is already working on this.
Since Jul 18, 2022.
type/feature-request
- Dominant language
- Go
- Stars
- 466
- Forks
- 338
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 8
Description
Feature Request
To configure Encryption at Rest feature, we need to copy the master key in advance to each TiKV/PD servers manually using scp.
Why the featue is needed:
It would be very helpful if tiup can copy the master key to each TiKV/PD servers based on the security.encryption.master-key.path setting to make the setup easier.
Describe alternatives you've considered:
So far we can copy the master file using scp. At least it requires to copy the file 6 times, 3 for PD and 3 for TiKV.
Teachability, Documentation, Adoption, Migration Strategy:
'Here is the sample yaml file.
pd_servers:
- host: <PD#1>
config:
security.encryption.data-encryption-method: "aes128-ctr"
security.encryption.data-key-rotation-period: "6h"
security.encryption.master-key.type: "file"
security.encryption.master-key.path: "/tmp/tidb-master-key"
- host: <PD#2>
config:
security.encryption.data-encryption-method: "aes128-ctr"
security.encryption.data-key-rotation-period: "6h"
security.encryption.master-key.type: "file"
security.encryption.master-key.path: "/tmp/tidb-master-key"
- host: <PD#3>
config:
security.encryption.data-encryption-method: "aes128-ctr"
security.encryption.data-key-rotation-period: "6h"
security.encryption.master-key.type: "file"
security.encryption.master-key.path: "/tmp/tidb-master-key"
tikv_servers:
- host: <TiKV#1>
config:
security.encryption.data-encryption-method: "aes128-ctr"
security.encryption.data-key-rotation-period: "6h"
security.encryption.master-key.type: "file"
security.encryption.master-key.path: "/tmp/tidb-master-key"
- host: <TiKV#2>
config:
security.encryption.data-encryption-method: "aes128-ctr"
security.encryption.data-key-rotation-period: "6h"
security.encryption.master-key.type: "file"
security.encryption.master-key.path: "/tmp/tidb-master-key"
- host: <TiKV#3>
config:
security.encryption.data-encryption-method: "aes128-ctr"
security.encryption.data-key-rotation-period: "6h"
security.encryption.master-key.type: "file"
security.encryption.master-key.path: "/tmp/tidb-master-key"
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.