Adding KMIP Global Key Providers for Standby KMIP Keystores

PostgreSQL PG_TDE – Transparent Data Encryption (TDE)
1

Hi All.

Two questions regarding Percona Postgresql V18 pg_tde:-

  1. Can you add more X1 KMIP key provider IP for KMIP redundancy/ standby server tests ?

Primary KMIP Keystore IP

SELECT pg_tde_add_global_key_provider_kmip(
‘kmip’,‘127.0.0.1’,
5696,
‘/tmp/server_certificate.pem’,
‘/tmp/client_cert_jane_doe.pem’,
‘/tmp/client_key_jane_doe.pem’
);

Standby KMIP Keystore IP

SELECT pg_tde_add_global_key_provider_kmip(
‘kmip’,‘127.0.0.1’,
5696,
‘/tmp/server_certificate.pem’,
‘/tmp/client_cert_jane_doe.pem’,
‘/tmp/client_key_jane_doe.pem’
);

I am currently testing this and will test failover if one KMIP keystore is not available? Has anyone implemented a similar solution before.

  1. On Certificate renewal, How do you rotate new Certs and keys ?

Kind Regards

Natasha

2

Hi Everyone.

I could add more than one provider. Now using the function (when online) or utility pg_tde_change_key_provider (when offline) to Change the IP’s for Key providers to test redundancy on KMIP keystores.

error: could not open tde file “/db pool/0_providers”: No such file or directory

The file under pg_tde directory is called 5_providers (same file name for V17 and V18).

Where can I fix this in order to run the command Offline as per Method 2 of Changing Key Providers?

I appreciate your feedback. Tx.

3

Hello!

Can you add more X1 KMIP key provider IP for KMIP redundancy/ standby server tests ?

Unfortunately that’s currently not supported.

On Certificate renewal, How do you rotate new Certs and keys ?

If you mean the kmip certificates, since those are files on the disk, you can simply overwrite them on disk.

Where can I fix this in order to run the command Offline as per Method 2 of Changing Key Providers?

Can you show me the exact commands you are executing for this test scenario?

4

Hellos!

Thank you for the response.

I could add X2 kmip key providers but not 3. The function allows more than X1 kmip provider however the encryption key links to one kmip provider.

pg_tde_add_database_key_provider_kmip

The change-provider function allows me to change the IP of the current provider to a new one.

pg_tde_change_database_key_provider_kmip

Method 1 Online Command ( Function)

Method 2 Command to run it as offline utility is below.

pg_tde_change_key_provider
-D /var/lib/postgresql/18/main
0
“current_provider_name”
kmip
“kmip-server.example.com”
5696
“/etc/ssl/certs/client.pem”
“/etc/ssl/private/client.key”
“/etc/ssl/certs/ca_root.pem”

Gettting error

pg_tde_change_key_provider: error: could not open tde file “/var/lib/postgresql/18/main/pg_tde/0_providers”: No such file or directory

The file is named 5_providers in Postgres V17 and V18.

5

Hi Natasha! Thanks for reaching out!

As Zsolt mentioned this is currently not supported.

Though something we’ve already been investigating was the possibility of providing fallback KMSs for handling KMS unavailability and your request could fall into the rework planned due to that.

Please share if you would be open to join a call to have some more discussion regarding your needs for such capability as we would like to make sure we understand them well. The more requirements we get the better the first version can be :slight_smile:

6

Good day Jan.

I’ll be happy to join a call. Let me know when.

Kind Regards

Natasha