Skip to content

PG-1257 Add function for principal key removal #374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

artemgavrilov
Copy link
Collaborator

@artemgavrilov artemgavrilov commented May 28, 2025

https://perconadev.atlassian.net/browse/PG-1257

Add SQL functions that allow user to remove principal key.

  • Database level principal key can be removed if there are no encrypted tables or if there is default key. For the first case we just drop key map file completely, for the second we perform key rotation.
  • Default principal key can be removed if there are no databases that use it.

@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch 2 times, most recently from 2849a87 to 179f5d7 Compare May 28, 2025 15:49
@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch from 1392bd7 to 5f91c64 Compare May 28, 2025 16:08
@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch from 5f91c64 to 369410e Compare May 28, 2025 21:09
@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch from 369410e to a18fe38 Compare May 28, 2025 22:16
@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch from a18fe38 to bd88553 Compare May 28, 2025 22:29
@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch from 4c1a316 to 4553814 Compare May 28, 2025 22:56
@artemgavrilov artemgavrilov marked this pull request as ready for review May 28, 2025 22:56
PG_RETURN_VOID();
}

pg_tde_delete_principal_key(MyDatabaseId, true);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it make sense that we delete the copy of the principal key from the database here? Probably but hmm ...

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure that I understood what confused you

Copy link
Collaborator

@jeltz jeltz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good but I had some minor comments.

Copy link
Collaborator

@jeltz jeltz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

Copy link
Collaborator

@Andriciuc Andriciuc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, approved!

Add SQL functions that allow user to remove principal key.

* Database level principal key can be removed if there are no encrypted tables or if there is default key. For the first case we just drop key map file completely, for the second we perform key rotation.
* Default principal key can be removed if there are no databases that use it.

Readded the DELETE key function to docs based on 1257 in Architecture chapter where we also update from DROP to DELETE.
@artemgavrilov artemgavrilov force-pushed the PG-1257-principal-key-remove-feature branch from 72d5fce to 5df6c58 Compare June 10, 2025 13:20
@nastena1606 nastena1606 temporarily deployed to PG-1257-principal-key-remove-feature - pg-tde-docs PR #374 June 10, 2025 13:20 — with Render Destroyed
@nastena1606 nastena1606 temporarily deployed to PG-1257-principal-key-remove-feature - INTERNAL-pg_tde docs PR #374 June 10, 2025 13:20 — with Render Destroyed
@artemgavrilov artemgavrilov merged commit 6007180 into TDE_REL_17_STABLE Jun 10, 2025
16 checks passed
@artemgavrilov artemgavrilov deleted the PG-1257-principal-key-remove-feature branch June 10, 2025 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants