8000 Prepare general docs for GA release (#434) · percona/postgres@dfcef9f · GitHub
[go: up one dir, main page]
Skip to content

Commit dfcef9f

Browse files
AndriciucAndriciuc
authored
Prepare general docs for GA release (#434)
Updated the introduction with the proper extension name, updated the intro to reflect this. Removed important note about not meant for production and added the No upgrade warning from previous versions (like RC2) to GA. Updates: * removed the block announcement for RC2 at the top of the HTML page in the intro * Added the warning note before installation begins too. * Updated site name to full name.
1 parent 33af938 commit dfcef9f

File tree

11 files changed

+23
-64
lines changed

11 files changed

+23
-64
lines changed

‎contrib/pg_tde/documentation/_resource/overrides/main.html

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,6 @@
33
-#}
44
{% extends "base.html" %}
55

6-
{% block announce %}
7-
This is the <strong>Release Candidate 2 (RC2)</strong> of Percona Transparent Data Encryption (TDE) extension.
8-
<p><strong>It is not recommended for production environments at this stage.</strong></p>
9-
<p>We encourage you to test it and <a href= "https://forums.percona.com/c/postgresql/pg-tde-transparent-data-encryption-tde/82">give your feedback</a>.
10-
This will help us improve the product and make it production-ready faster.</p>
11-
{% endblock %}
12-
136
{% block scripts %}
147
<script src="https://cmp.osano.com/Azqe5vTyLOSbN3OuT/49ad85b5-0418-4794-ab81-7599dddd534c/osano.js"></script>
158
{{ super() }}

‎contrib/pg_tde/documentation/_resourcepdf/overrides/main.html

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,6 @@
33
-#}
44
{% extends "base.html" %}
55

6-
{% block announce %}
7-
This is the <strong>Release Candidate 2 (RC2)</strong> of Percona Transparent Data Encryption (TDE) extension.
8-
<p><strong>It is not recommended for production environments at this stage.</strong></p>
9-
<p>We encourage you to test it and <a href= "https://forums.percona.com/c/postgresql/pg-tde-transparent-data-encryption-tde/82">give your feedback</a>.
10-
This will help us improve the product and make it production-ready faster.</p>
11-
{% endblock %}
12-
136
{% block scripts %}
147
<script src="https://cmp.osano.com/Azqe5vTyLOSbN3OuT/49ad85b5-0418-4794-ab81-7599dddd534c/osano.js"></script>
158
{{ super() }}

‎contrib/pg_tde/documentation/docs/architecture/index.md

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -239,21 +239,17 @@ This is also the reason why it requires a `dbOid` instead of a name, as it has n
239239

240240
### Deleting providers
241241

242-
Providers can be deleted by using the
242+
Providers can be deleted by using the following functions:
243243

244244
```sql
245245
pg_tde_delete_database_key_provider(provider_name)
246246
pg_tde_delete_global_key_provider(provider_name)
247247
```
248248

249-
functions.
250-
251249
For database specific providers, the function first checks if the provider is used or not, and the provider is only deleted if it's not used.
252250

253251
For global providers, the function checks if the provider is used anywhere, WAL or any specific database, and returns an error if it is.
254252

255-
This somewhat goes against the principle that `pg_tde` should not interact with other databases than the one the user is connected to, but on the other hand, it only does this lookup in the internal `pg_tde` metadata, not in postgres catalogs, so it is a gray zone. Making this check makes more sense than potentially making some databases inaccessible.
256-
257253
### Listing/querying providers
258254

259255
`pg_tde` provides 2 functions to show providers:
@@ -263,17 +259,6 @@ This somewhat goes against the principle that `pg_tde` should not interact with
263259

264260
These functions return a list of provider names, type and configuration.
265261

266-
### Provider permissions
267-
268-
`pg_tde` implements access control based on execution rights on the administration functions.
269-
270-
For keys and providers administration, it provides two pair of functions:
271-
272-
```sql
273-
pg_tde_GRANT_database_key_management_TO_role
274-
pg_tde_REVOKE_database_key_management_FROM_role
275-
```
276-
277262
### Creating and rotating keys
278263

279264
Principal keys can be created using the following functions:
@@ -325,12 +310,6 @@ The `pg_tde_delete_key()` function unsets the principal key for the current data
325310

326311
`pg_tde_verify_key()` checks that the key provider is accessible, that the current principal key can be downloaded from it, and that it is the same as the current key stored in memory - if any of these fail, it reports an appropriate error.
327312

328-
### Key permissions
329-
330-
Users with management permissions to a specific database `(pg_tde_(grant/revoke)_(global/databse)_key_management_(to/from)_role)` can change the keys for the database, and use the current key functions. This includes creating keys using global providers, if `pg_tde.inherit_global_providers` is enabled.
331-
332-
Also the `pg_tde_(grant/revoke)_database_key_management_to_role` function deals with only the specific permission for the above function: it allows a user to change the key for the database, but not to modify the provider configuration.
333-
334313
### Creating encrypted tables
335314

336315
To create an encrypted table or modify an existing table to be encrypted, use the following commands:

‎contrib/pg_tde/documentation/docs/faq.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Using TDE helps you avoid the following risks:
2727

2828
If to translate sensitive data to files stored in your database, these are user data in tables, temporary files, WAL files. TDE has you covered encrypting all these files.
2929

30-
`pg_tde` does not encrypt system catalogs yet. This means that statistics data and database metadata are not encrypted. The encryption of system catalogs is planned for future releases.
30+
`pg_tde` does not encrypt system catalogs yet. This means that statistics data and database metadata are not encrypted.
3131

3232
## Will logical replication work with pg_tde?
3333

@@ -121,7 +121,9 @@ We advise encrypting the whole database only if all your data is sensitive, like
121121

122122
For WAL encryption, AES-CTR-128 is used.
123123

124-
The support of other encryption mechanisms such as AES256 is planned for future releases. Reach out to us with your requirements and u F438 sage scenarios of other encryption methods are needed.
124+
## Is post-quantum encryption supported?
125+
126+
No, it's not yet supported. In our implementation we reply on OpenSSL libraries that don't yet support post-quantum encryption.
125127

126128
## Can I encrypt an existing table?
127129

‎contrib/pg_tde/documentation/docs/functions.md

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,6 @@
22

33
The `pg_tde` extension provides functions for managing different aspects of its operation:
44

5-
## Permission management
6-
7-
By default, `pg_tde` is locked down. No one is allowed to do any operations until you grant them permissions. Only superusers may add or alter global key providers.
8-
9-
However, database owners can run the “view keys” and “set principal key” functions on their own databases. You can delegate these rights to other roles with the following commands:
10-
11-
* `GRANT EXECUTE ON FUNCTION`
12-
* `REVOKE EXECUTE ON FUNCTION`
13-
145
## Key provider management
156

167
A key provider is a system or service responsible for managing encryption keys. `pg_tde` supports the following key providers:

‎contrib/pg_tde/documentation/docs/global-key-provider-configuration/kmip-server.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ For testing purposes, you can use a lightweight PyKMIP server, which enables eas
1515
SELECT pg_tde_add_global_key_provider_kmip(
1616
'provider-name',
1717
'kmip-IP',
18-
5696,
18+
`port`,
1919
'/path_to/server_certificate.pem',
2020
'/path_to/client_cert.pem',
2121
'/path_to/client_key.pem' 10000 ;

‎contrib/pg_tde/documentation/docs/how-to/multi-tenant-setup.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,13 @@ You must do these steps for every database where you have created the extension.
6464
6565
```sql
6666
SELECT pg_tde_add_database_key_provider_kmip(
67-
'provider-name',
68-
'kmip-addr',
69-
5696,
70-
'/path_to/client_cert.pem',
71-
'/path_to/client_key.pem',
72-
'/path_to/server_certificate.pem'
73-
);
67+
'provider-name',
68+
'kmip-addr',
69+
`port`,
70+
'/path_to/client_cert.pem',
71+
'/path_to/client_key.pem',
72+
'/path_to/server_certificate.pem'
73+
);
7474
```
7575
7676
where:

‎contrib/pg_tde/documentation/docs/index.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1-
# pg_tde Documentation
1+
# Percona Transparent Data Encryption for PostgreSQL documentation
22

3-
`pg_tde` is the open source, community driven and futureproof PostgreSQL extension that provides Transparent Data Encryption (TDE) to protect data at rest. `pg_tde` ensures that the data stored on disk is encrypted, and that no one can read it without the proper encryption keys, even if they gain access to the physical storage media.
3+
Percona Transparent Data Encryption for PostgreSQL (`pg_tde`) is an open source, community driven and futureproof PostgreSQL extension that provides Transparent Data Encryption (TDE) to protect data at rest. `pg_tde` ensures that the data stored on disk is encrypted, and that no one can read it without the proper encryption keys, even if they gain access to the physical storage media.
44

5-
!!! important
6-
This is the {{release}} version of the extension and **it is not meant for production use yet**. We encourage you to use it in testing environments and [provide your feedback](https://forums.percona.com/c/postgresql/pg-tde-transparent-data-encryption-tde/82).
5+
!!! warning "No upgrade path from RC to GA"
6+
There is no safe upgrade path from the previous versions, such as Release Candidate 2, to the General Availability (GA) version of `pg_tde`.
7+
We recommend starting with a **clean installation** for GA deployments. Avoid using RC environments in production.
78

89
[Overview](index/index.md){.md-button}
910
[Get Started](install.md){.md-button}

‎contrib/pg_tde/documentation/docs/install.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Install pg_tde
22

3-
<!-- !!! warning "No upgrade path from RC to GA"
4-
There is no safe upgrade path from the Release Candidate 2 (RC2) to the General Availability (GA) version of `pg_tde`.
5-
We recommend starting with a **clean installation** for GA deployments. Avoid using RC environments in production. -->
3+
!!! warning "No upgrade path from RC to GA"
4+
There is no safe upgrade path from the previous versions, such as Release Candidate 2, to the General Availability (GA) version of `pg_tde`.
5+
We recommend starting with a **clean installation** for GA deployments. Avoid using RC environments in production.
66

77
To install `pg_tde`, use one of the following methods:
88

‎contrib/pg_tde/documentation/docs/templates/pdf_cover_page.tpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@
77
{% if config.site_description %}
88
<h1>{{ config.site_description }}</h1>
99
{% endif %}
10-
<h2>Release Candidate (2025-03-27)</h2>
10+
<h2> 1.0 (2025-06-30)</h2>
1111
<!--<h3>Percona Technical Documentation Team</h3>-->

‎contrib/pg_tde/documentation/mkdocs.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# MkDocs general configuration
22

3-
site_name: pg_tde documentation
3+
site_name: Percona Transparent Data Encryption for PostgreSQL
44
site_description: Documentation
55
site_author: Percona LLC
66
copyright: >

0 commit comments

Comments
 (0)
0