Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: support encryption for backup data #6723

Merged
merged 2 commits into from
Mar 5, 2024
Merged

Conversation

zjx20
Copy link
Contributor

@zjx20 zjx20 commented Mar 1, 2024

This PR integrates data encryption functionality from datasafed. Backup data is encrypted before being written to storage. Currently, the supported encryption algorithms are AES-128-CFB, AES-192-CFB, and AES-256-CFB. In the future, additional algorithms can be supported based on requirements.

Usage instructions:

  1. Create a Secret to store the encryption key:

    kubectl create secret generic backup-encryption \
      --from-literal=secretKey='your secret key'
  2. Patch the backupPolicy to enable encryption. Reference the previously created key here:

    kubectl --type merge patch backuppolicy mysqlcluster-mysql-backup-policy \
      -p '{"spec":{"encryptionConfig":{"algorithm":"AES-256-CFB","passPhraseSecretKeyRef":{"name":"backup-encryption","key":"secretKey"}}}}'
  3. Configuration is complete. Perform backups and restores as usual.

Note: The content of the Secret created in step one should not be modified or deleted; otherwise, decryption of backups will fail in the future.

Subsequent simplification of these operations can be achieved through kbcli.

Close #6722.

@github-actions github-actions bot added the size/L Denotes a PR that changes 100-499 lines. label Mar 1, 2024
@apecloud-bot apecloud-bot requested a review from realzyy March 1, 2024 07:28
Copy link

codecov bot commented Mar 1, 2024

Codecov Report

Attention: Patch coverage is 42.10526% with 33 lines in your changes are missing coverage. Please review.

Project coverage is 66.40%. Comparing base (714cbb3) to head (ed5bf6c).
Report is 5 commits behind head on main.

Files Patch % Lines
pkg/dataprotection/utils/backuprepo.go 0.00% 19 Missing ⚠️
controllers/dataprotection/utils.go 57.89% 6 Missing and 2 partials ⚠️
controllers/dataprotection/backup_controller.go 75.00% 2 Missing and 1 partial ⚠️
pkg/dataprotection/restore/builder.go 33.33% 2 Missing ⚠️
pkg/dataprotection/backup/deleter.go 50.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6723      +/-   ##
==========================================
+ Coverage   66.35%   66.40%   +0.04%     
==========================================
  Files         305      305              
  Lines       36662    36715      +53     
==========================================
+ Hits        24326    24379      +53     
  Misses      10238    10238              
  Partials     2098     2098              
Flag Coverage Δ
unittests 66.40% <42.10%> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Collaborator

@ldming ldming left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@zjx20 zjx20 merged commit fcd1aa8 into main Mar 5, 2024
80 checks passed
@zjx20 zjx20 deleted the feature/backup-encryption branch March 5, 2024 04:03
@github-actions github-actions bot added this to the Release 0.8.2 milestone Mar 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/user-interaction feature size/L Denotes a PR that changes 100-499 lines.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Features] backup data encryption
4 participants