How to change token of harshicop vault

PostgreSQL PG_TDE – Transparent Data Encryption (TDE)
1

Hi,

we are using vault for pg_tde, we already add vault_v2 and set principle key, but now we want to change vault token, how to do that

SELECT pg_tde_add_key_provider_vault_v2(‘provider-name’,:‘secret_token’,‘url’,‘mount’,‘ca_path’);

2

Hi! Thanks for reaching out!

For now, the way to do it is to add a new provider and change the principal key to the new provider as we have not add yet functions to modify/delete a provider. These are already planned, just the priority now is with hardening and use cases that have no workarounds.

Can you share some more about the use case where you tested pg_tde? Is this workaround I presented something that can get you through your issue?

3

because our vault token was expired so that DB cannot get master key from vault. From vault site they already recreate token but we can not update from DB site, when token expired, i cannot do anything for add new provider or change principle key

4

is there any way to backup and restore principle key, incase there is some issue with provider?

5

Hello!

We have no interface for this at the moment, we’ll add it in the future. In the meantime, you can try editing the datafile for pg_tde manually (make sure that the server is stopped during this, and make a backup of the file before).

The data file is in the data directory, with a path /base/<database_oid>/pg_tde_keyrings

6

Hi, /base/<database_oid>/pg_tde_keyrings is binary file, how can i edit and replace new token?

7

try to edit with vi, when restart db and select encrypted table, the error:

ERROR: key provider info file is corrupted: No such file or directory
DETAIL: invalid key provider record size 1 expected 1160

8

Hello

Yes, it’s binary. You can use vim in hex/binary mode, for example:

vim -b <filename>
:%!xxd
:%!xxd -r (to save it)

but this als depends on your vimrc/configuration.

Or you can edit the file with a command line hex/binary editor, there are many available.

9

i already edit new token, but still error, is there any DB checksum info that check to make sure no manual edit?

ERROR: key provider info file is corrupted: No such file or directory
DETAIL: invalid key provider record size 1 expected 1160