Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PG-1244 Added a limitation about KMS configuration update #373

Merged
merged 4 commits into from
Dec 26, 2024
Merged

PG-1244 Added a limitation about KMS configuration update #373

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
05ce301
PG-1244 Added a limitation about KMS confoguration update
nastena1606 Dec 9, 2024
f8a526e
Added Contact us call to action
nastena1606 Dec 10, 2024
226e53d
Updated the limitation after the review
nastena1606 Dec 16, 2024
356c8d3
Merge branch 'main' into PG-1244-Doc-KMS-update-limitations
nastena1606 Dec 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions documentation/docs/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,13 @@ Lear more [what is Transparent Data Encryption](tde.md#how-does-it-work) and [wh

* Keys in the local keyfile are stored unencrypted. For better security we recommend using the Key management storage.
* System tables are currently not encrypted.
* Currently you cannot update the configuration of an existing Key Management Store (KMS). If its configuration changes (e.g. your Vault server has a new URL), you must set up a new key provider in `pg_tde` and create new keys there. Both the KMS and PostgreSQL servers must be up and running during these changes. [Reach out to our experts](https://www.percona.com/about/contact) for assistance and to outline the best update path for you.

We plan to introduce the way to update the configuration of an existing KMS in future releases.

* `pg_rewind` doesn't work with encrypted WAL for now. We plan to fix it in future releases.


<i warning>:material-alert: Warning:</i> Note that introducing encryption/decryption affects performance. Our benchmark tests show less than 10% performance overhead for most situations. However, in some specific applications such as those using JSONB operations, performance degradation might be higher.

## Versions and supported PostgreSQL deployments
Expand Down
Loading