Help with TDE setup in Percona MySQL 8 pxc cluster

MySQL & MariaDB Percona XtraDB Cluster 8.x
1

Hello MySQL community,
I need help with the issue configuring TDE in PXC Galera 3-node cluster. Used the below configuration in my.cnf on all 3 nodes.

[mysqld]
early-plugin-load=keyring_file.so
keyring_file_data= /home/mysqladm/TDE_Key/keyring_$node0
ssl-ca=/home/mysqladm/mysql-ssl/ssl-ca-$hostname
ssl-cert=/home/mysqladm/mysql-ssl/ssl-cert-$hostname
ssl-key=/home/mysqladm/mysql-ssl/ssl-key-$hostname

[sst]
streamfmt=xbstream
encrypt=4
ssl-ca=/home/mysqladm/mysql-ssl/ssl-ca-$hostname
ssl-cert=/home/mysqladm/mysql-ssl/ssl-cert-$hostname
ssl-key=/home/mysqladm/mysql-ssl/ssl-key-$hostname

[xtrabackup]
keyring_file_data= /home/mysqladm/TDE_Key/keyring_$node0

Issue: startup fails with error:
2024-08-01T18:45:15.149622Z 0 [ERROR] [MY-000067] [Server] unknown variable ‘streamfmt=xbstream’.
2024-08-01T18:45:15.149731Z 0 [ERROR] [MY-010119] [Server] Aborting

Attempt after commenting out the parameter streamfmt=xbstream then threw the error:
2024-08-01T19:13:50.530577Z 0 [ERROR] [MY-000067] [Server] unknown variable ‘encrypt=4’.
2024-08-01T19:13:50.530653Z 0 [ERROR] [MY-010119] [Server] Aborting

Thank you,
Vasavi

2

Have you looked through our documentation on this?

3

Thank you Matthew for the response.

We are generating keys and certificates manually using internal certificates. For TDE, we are using keyring-plugin for now.
( as in Simplified Percona XtraDB Cluster SSL Configuration).

We copied the key, cert and ca files from node 0 to rest of the 2 nodes, but named the files to reflect the respective hostname and specified the names in my.cnf on respective nodes as I posted before.
With the current setup, I can still see them valid.

ssl-cert-rn000158897: OK

Should we still name the files ( key, cert and ca files ) same as in node 0?

Reg the below error, we are planning to enable pxc_encrypt_cluster_traffic as a next step.

024-08-02T02:41:32.195319Z 0 [Warning] [MY-000000] [WSREP] You have enabled keyring plugin. SST encryption is mandatory. Please enable pxc_encrypt_cluster_traffic. Check https:
//docs.percona.com/percona-xtradb-cluster/8.0/encrypt-traffic.html#encrypt-sst-traffic for more details.

I will update how it goes.

Thank you,
Vasavi

4

We are all set with the current configuration.

  • Enabled pxc_encrypt_cluster_traffic
  • Commented out streamfmt=xbstream

Thank you,
Vasavi