Skip to content

Commit 650c909

Browse files
authored
PG-1804 - Remove outdated and duplicate Enable encryption topic from docker.md PSP 17 (#830)
* remove outdated and duplicate Enable encryption topic from docker setup and improve steps
1 parent 33337c6 commit 650c909

File tree

2 files changed

+19
-67
lines changed

2 files changed

+19
-67
lines changed

docs/docker.md

Lines changed: 18 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -98,9 +98,10 @@ Where:
9898
9999
## Enable encryption
100100
101-
Percona Distribution for PostgreSQL Docker image includes the `pg_tde` extension to provide data encryption. You must explicitly enable it when you start the container. For more information, see the [pg_tde documentation](https://docs.percona.com/pg-tde/index.html).
101+
Percona Distribution for PostgreSQL Docker image includes the `pg_tde` extension to provide data encryption. You must explicitly enable it when you start the container. For more information, see the [pg_tde documentation :octicons-link-external-16:](https://docs.percona.com/pg-tde/index.html).
102102
103103
Follow these steps to enable `pg_tde`:
104+
{.power-number}
104105
105106
1. Start the container with the `ENABLE_PG_TDE=1` environment variable:
106107
@@ -123,7 +124,7 @@ Follow these steps to enable `pg_tde`:
123124
??? example "Sample output"
124125
125126
```{.text .no-copy}
126-
psql ({{dockertag}} - Percona Server for PostgreSQL {{dockertag}}.1)
127+
psql ({{pgsubversion}} - Percona Server for PostgreSQL {{dockertag}})
127128
Type "help" for help.
128129
129130
postgres=#
@@ -135,7 +136,7 @@ Follow these steps to enable `pg_tde`:
135136
CREATE EXTENSION pg_tde;
136137
```
137138
138-
4. Configure a key provider with a keyring file. This setup is intended for development and stores the keys unencrypted in the specified data file. The below sample configuration is intended for testing and development purposes.
139+
4. Add the key provider by using a keyring file. This setup is intended for development and stores the keys unencrypted in the specified data file. The below sample configuration is intended for testing and development purposes only.
139140
140141
!!! note
141142
For production use, we **strongly recommend** setting up an external key management store and configure an external key provider. Refer to the [Setup :octicons-link-external-16:](https://docs.percona.com/pg-tde/setup.html#key-provider-configuration) topic in the `pg_tde` documentation.
@@ -146,85 +147,35 @@ Follow these steps to enable `pg_tde`:
146147
SELECT pg_tde_add_database_key_provider_file('file-vault', '/tmp/pg_tde_test_001_basic.per');
147148
```
148149
150+
5. Create the key:
151+
152+
```sql
153+
SELECT pg_tde_create_key_using_database_key_provider('test-db-key', 'file-vault');
154+
```
155+
149156
5. Set the principal key:
150157
151158
```sql
152159
SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'file-vault');
153160
```
154161
155-
The key is auto-generated. You are ready to use data encryption.
156-
157162
6. Create a table with encryption enabled. Pass the `USING tde_heap` clause to the `CREATE TABLE` command:
158163
159164
```sql
160165
CREATE TABLE <table_name> (<field> <datatype>) USING tde_heap;
161166
```
162167
163-
## Enable encryption
164-
165-
Percona Distribution for PostgreSQL Docker image includes the `pg_tde` extension to provide data encryption. You must explicitly enable it when you start the container.
166-
167-
Here's how to do this:
168-
{.power-number}
169-
170-
1. Start the container with the `ENABLE_PG_TDE=1` environment variable:
171-
172-
```{.bash data-prompt="$"}
173-
$ docker run --name container-name -e ENABLE_PG_TDE=1 -e POSTGRES_PASSWORD=sUpers3cRet -d percona/percona-distribution-postgresql:{{dockertag}}-multi
174-
```
175-
176-
where:
177-
178-
* `container-name` is the name you assign to your container
179-
* `ENABLE_PG_TDE=1` adds the `pg_tde` to the `shared_preload_libraries` and enables the custom storage manager
180-
* `POSTGRES_PASSWORD` is the superuser password
181-
182-
183-
2. Connect to the container and start the interactive `psql` session:
184-
185-
```{.bash data-prompt="$"}
186-
$ docker exec -it container-name psql
187-
```
188-
189-
??? example "Sample output"
190-
191-
```{.text .no-copy}
192-
psql ({{dockertag}} - Percona Server for PostgreSQL {{dockertag}}.1)
193-
Type "help" for help.
168+
??? example "CREATE TABLE example"
194169
195-
postgres=#
170+
```{.sql .no-copy}
171+
CREATE TABLE test_users (
172+
user_id INT,
173+
username VARCHAR(50),
174+
email VARCHAR(100),
175+
signup_date DATE
176+
) USING tde_heap;
196177
```
197178
198-
3. Create the extension in the database where you want to encrypt data. This requires superuser privileges.
199-
200-
```sql
201-
CREATE EXTENSION pg_tde;
202-
```
203-
204-
4. Configure a key provider. In this sample configuration intended for testing and development purpose, we use a local keyring provider.
205-
206-
For production use, set up an external key management store and configure an external key provider. Refer to the [Setup :octicons-link-external-16:](https://percona.github.io/pg_tde/main/setup.html#key-provider-configuration) chapter in the `pg_tde` documentation.
207-
208-
<i warning>:material-information: Warning:</i> This example is for testing purposes only:
209-
210-
```sql
211-
SELECT pg_tde_add_key_provider_file('file-keyring','/tmp/pg_tde_test_local_keyring.per');
212-
```
213-
214-
5. Add a principal key
215-
216-
```sql
217-
SELECT pg_tde_set_principal_key('test-db-master-key','file-keyring');
218-
```
219-
220-
The key is autogenerated. You are ready to use data encryption.
221-
222-
6. Create a table with encryption enabled. Pass the `USING tde_heap` clause to the `CREATE TABLE` command:
223-
224-
```sql
225-
CREATE TABLE <table_name> (<field> <datatype>) USING tde_heap;
226-
```
227-
228179
## Enable `pg_stat_monitor`
229180
230181
To enable the `pg_stat_monitor` extension after launching the container, do the following:

variables.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
release: 'release-notes-v17.5'
66
dockertag: '17.5-2'
7+
pgsubversion: '17.5'
78
pgversion: '17'
89
pspgversion: '17.5.2'
910
pgsmversion: '2.1.1'

0 commit comments

Comments
 (0)