feat: support encryption for backup data #6723
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR integrates data encryption functionality from datasafed. Backup data is encrypted before being written to storage. Currently, the supported encryption algorithms are
AES-128-CFB
,AES-192-CFB
, andAES-256-CFB
. In the future, additional algorithms can be supported based on requirements.Usage instructions:
Create a Secret to store the encryption key:
kubectl create secret generic backup-encryption \ --from-literal=secretKey='your secret key'
Patch the backupPolicy to enable encryption. Reference the previously created key here:
kubectl --type merge patch backuppolicy mysqlcluster-mysql-backup-policy \ -p '{"spec":{"encryptionConfig":{"algorithm":"AES-256-CFB","passPhraseSecretKeyRef":{"name":"backup-encryption","key":"secretKey"}}}}'
Configuration is complete. Perform backups and restores as usual.
Note: The content of the Secret created in step one should not be modified or deleted; otherwise, decryption of backups will fail in the future.
Subsequent simplification of these operations can be achieved through kbcli.
Close #6722.