-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Provide encryption support with fdbbackup modify command #12554
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Result of foundationdb-pr-clang-ide on Linux RHEL 9
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr-clang-ide on Linux RHEL 9
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr-macos-m1 on macOS Ventura 13.x
|
Result of foundationdb-pr-macos on macOS Ventura 13.x
|
Result of foundationdb-pr-clang-ide on Linux RHEL 9
|
Result of foundationdb-pr-macos-m1 on macOS Ventura 13.x
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-macos on macOS Ventura 13.x
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
| Optional<Version> existingEncryptionMetadata = wait(bc->fileLevelEncryption().get()); | ||
|
|
||
| if (!existingEncryptionMetadata.present()) { | ||
| bool exists = wait(bc->exists()); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the case where bc does not exist?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is bit tricky.
I wanted to create FileLevelEncryption file in properties if a url is modify so that when fdbbackup describe is called, it shows the file level encryption information.
But for Local Directory, directory/backup container is not created during create but when files are actually written.
This is not the case with S3
So there is no way (this is what I understand) to create encryption metadata file unless I create when backup files are written/created and add check (if encryption property metadata exist, skip). But I wanted to avoid that check for so many files.
This is not the case with backup submit because in backup submit I added the check on finish task when backups are ready to start and there is no duplication.
But no such thing is there in backup modify. Url is changed and config is updated and backup agents just pick up the task and start writing (with updating url).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hope it makes sense! Let me know, I can go over the code as well.
3217796 to
0f2b559
Compare
Result of foundationdb-pr-clang-ide on Linux RHEL 9
|
Result of foundationdb-pr-macos-m1 on macOS Ventura 13.x
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-macos on macOS Ventura 13.x
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
|
Jobs are failing but they are not showing any error: |
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
Result of foundationdb-pr-clang-ide on Linux RHEL 9
|
Result of foundationdb-pr-macos-m1 on macOS Ventura 13.x
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr-macos on macOS Ventura 13.x
|
|
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
Result of foundationdb-pr-clang-ide on Linux RHEL 9
|
Result of foundationdb-pr-macos-m1 on macOS Ventura 13.x
|
Result of foundationdb-pr-clang-arm on Linux CentOS 7
|
Result of foundationdb-pr-macos on macOS Ventura 13.x
|
Result of foundationdb-pr on Linux RHEL 9
|
Result of foundationdb-pr-clang on Linux RHEL 9
|
Result of foundationdb-pr-cluster-tests on Linux RHEL 9
|
| .detail("EncryptionKeyFile", | ||
| options.encryptionKeyFile.present() ? options.encryptionKeyFile.get() : "None"); | ||
| bc = openBackupContainer( | ||
| exeBackup.toString().c_str(), options.destURL.get(), options.proxy, options.encryptionKeyFile); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the case of, they give the same URL but a new encryption key what will happen?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's a great point. I didn't check that scenario.
From the code - it looks like it will start encrypting with the new encryption key as container will be opened unless container gives an error if reopened.
Let me try this scenario first.
Provide encryption support with fdbbackup modify command
to address issue #12544
In
fdbbackupmodify command, user need to pass--encryption-key-filealong with new url to encrypt the backup data.Steps to reproduce mentioned in #12544 (comment)
Testing
fdbbackup start -C /root/local_testing/loopback-cluster/fdb.cluster -t mybackup -d file:///root/local_testing/backup_before/ --encryption-key-file /root/local_testing/key_file --no-stop-when-done -s 60 --log --logdir=/root/local_testing/logsWhile backup is running, modify the url to backup_after and provide encryption key
fdbbackup modify -C /root/local_testing/loopback-cluster/fdb.cluster -t mybackup -d file:///root/local_testing/backup_after/ --encryption-key-file /root/local_testing/key_file --log --logdir=/root/local_testing/logsFor new backup location:
6.1 If wrong key is provided for backup_after
6.2 If same encryption key is provided for backup_after
Completed 100k simulation test -
20251114-195339-akankshamahajan-a2de62864f86153e compressed=True data_size=38554198 duration=4754822 ended=100000 fail_fast=10 max_runs=100000 pass=100000 priority=100 remaining=0 runtime=1:15:54 sanity=False started=100000 stopped=20251114-210933 submitted=20251114-195339 timeout=5400 username=akankshamahajan