Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement PXB-3155 - Move keyring vault to component #1500

Merged
merged 3 commits into from
Oct 16, 2023

Conversation

altmannmarcelo
Copy link
Contributor

https://jira.percona.com/browse/PXB-3155

Cherry-picked relevant commits:
percona/percona-server@96b9441
percona/percona-server@92926e1

Adjusted PXB-related code to understand the vault as a component and fixed test cases.

oleksandr-kachan and others added 3 commits October 16, 2023 08:09
https://jira.percona.com/browse/PS-8854
(cherry picked from commit 96b944152c7b2737fa317c695b07b584bac52bdd)
…ersion_v2 used

https://jira.percona.com/browse/PS-8854

Vault version Vault_version_v2 keeps records history on backend. In some
situations keyring_vault may get records for already deleted keys (with
empty 'data' and 'deletion_time' set) while populating keyring component
cache during its startup. At the moment keyring_vault cannot process
such data records properly. This leads to component loading failure.

To fix the issue data records parser updated to handle such deleted
entries. They are skipped while populating component cache.

(cherry picked from commit 92926e1533384d2a666e4a8d50f43540eff30451)
https://jira.percona.com/browse/PXB-3155

Moved the keyring vault from plugin to component.
Adjusted the necessary tests to properly instantiate the component
configuration.
@it-percona-cla
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ altmannmarcelo
❌ oleksandr-kachan
You have signed the CLA already but the status is still pending? Let us recheck it.

@altmannmarcelo
Copy link
Contributor Author

Manual Tests

We still don't have a valid PS version with vault as component, so no jenkins:

VAULT_URL=https://127.0.0.1:8200 VAULT_CACERT=${HOME}/vault.crt VAULT_CA=${HOME}/vault.crt VAULT_TOKEN=hvs.Aa83Us0I985GUVjjqCXVYbku ./run.sh -r /dev/shm/ -d /work/ps/ins/8.0/ -f -s keyring
Using /dev/shm//var as test root
Detecting server version...
Running against Percona Server 8.1.0-1-debug (XtraDB 8.1.0-1)
Using 'xtrabackup' as xtrabackup binary
Autodetected number of cores: 32
Limiting to 16 to avoid excessive resource consumption
Using 16 parallel workers
Running suite(s): keyring

==============================================================================
TEST                                   WORKER    RESULT     TIME(s) or COMMENT
------------------------------------------------------------------------------
innodb_keyring_kmip_component            w9	[skipped]   Keyring kmip requires KMIP Server configured
innodb_keyring_plugin_to_component       w9	[skipped]   Disabled until PXB-2969 is fixed
innodb_keyring_kms_component             w10	[skipped]   Keyring kms requires KMS variables configured
keyring_encryption                       w15	[skipped]   Requires server version lower than 8.0.30
bug1590351                               w2	[passed]    23
innodb_keyring_proxy_plugin              w9	[passed]    27
pxb-1705                                 w16	[passed]    35
innodb_encryption_mix_plugins            w5	[passed]    37
basic_encrytion                          w1	[passed]    44
pxb-1793                                 w2	[passed]    23
innodb_encryption_export                 w4	[passed]    54
pxb-1903                                 w16	[passed]    27
bug1737525                               w3	[passed]    67
pxb-1954                                 w2	[passed]    27
pxb-1937                                 w1	[passed]    30
pxb-1879                                 w9	[passed]    59
pxb-1936                                 w5	[passed]    50
pxb-2429                                 w4	[passed]    34
innodb_redo_log_encrypt                  w14	[passed]    98
shared_tablespace_encryption             w1	[passed]    39
reencrypt                                w3	[passed]    48
rollback                                 w2	[passed]    52
system_tablespace_encryption             w9	[passed]    41
keyring_pxb_2275                         w15	[passed]    143
innodb_keyring_vault_auto_v2             w11	[passed]    144
innodb_keyring_vault_auto_v1             w10	[passed]    146
innodb_keyring_vault_v2                  w13	[passed]    146
innodb_keyring_vault_v1                  w12	[passed]    151
xb_log_archiving_encrypt                 w5	[passed]    74
innodb_keyring_file_plugin               w8	[passed]    211
redo_log_archive                         w16	[passed]    173
innodb_keyring_file_both                 w6	[passed]    241
innodb_keyring_file_component            w7	[passed]    274
==============================================================================
Spent 2518 of 293 seconds executing testcases

SUMMARY: 33 run, 29 successful, 4 skipped, 0 failed

Skipped tests:  innodb_keyring_kmip_component innodb_keyring_plugin_to_component innodb_keyring_kms_component keyring_encryption

See results/ for detailed output

Copy link
Contributor

@satya-bodapati satya-bodapati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@altmannmarcelo altmannmarcelo merged commit 05709ab into percona:release-8.1.0.1 Oct 16, 2023
2 of 3 checks passed
@altmannmarcelo altmannmarcelo deleted the PXB-3155-8.1 branch October 16, 2023 12:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants