Merge back release 17.5.2 #463
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Since we only looked at the parent table and not on the whole tree when setting the status of the encrypted indexes we could easily accidentally create a plain text index on an encrypted table. This patch also makes sure to disallow adding indexes to an inheritance tree where the tables are a mix of encrypted and unecrypted tables.
Since partitioned tables do not have any sotrage and only control the default access method of their children we should not try to change the encryption status of anything when changing the AM of a partitioned table.
The poll_start function handles both slow kill -9 and slow startup while kill9_until_dead only really handles one of them.
This "to" had no business being in this message.
Wrote a general topic regarding Encrpytion Enforcement from pg_tde perspective.
Created new replication topic which outlines how to set up PostgreSQL streaming replication when the `pg_tde` extension, specifically the `tde_heap` access method, is enabled on the primary server.
The function this message referenced does not exist, and even if it did it wouldn't create keys. Also error hint messages are supposed to be full sentences with capital letter and period.
Added a new topic: - How can I store an old key securely? Use Vault as an example here. - ~~Explain how you can use this “old” principal key to unencrypt your backups.~~ Removed files like FAQ and others that do not belong to this PR.
setup.md: Modified file to be postgresql.conf file Modified last note to be clearer. test.md: UPdated function return for step 2 checking encrypted data variables.md: Added warning note for Enabling WAL encryption. yum.md: Updated Memory Lock description.
* uninstall.md added warning note and added a new step to ensure user knows he needs to decrypt or drop encrypted tables * rewrote table access ALTER SYSTEM command * for limitations.md, removed rewind mention and added WAL note as text, made small changes to RC version. Added note for KMS, improved system tables text. Multi-tenant-setup.md: * updated SELECT parameters * Added that KMIP server setup is out of scope. * Added a link to KMS configuration chapter in the intro to Key provider config
- updated FAQ with WAL encryption notes about it's beta status - updated links to How does pg_tde make my data safe? FAQ for KMS chapters we added - updated pg_waldump with a note about wal encryption beta status - Removed post quantum question from FAQ
Add principal key deletion functions to documentation. Fix couple uncertainties on architecture docs page.
reverted set key changes for architecture, functions, set principal key and multi-tenant-setup.md
In set-principal-key.md: * updated with correct code example using set_server_key_using_global parameter * updated note to reflect correct config In features.md: * Removed temporary tables feature to clear confusion, removed logical replication mention, removed WAL encryption as a feature. In functions.md: * Added ON FUNCTION for grant/revoke execution * Modified sensitive info bolded paragraph to important note * Small modifications to notes display, title cases and text fixes * added note to Add or modify Vault providers for keeping the same principal key. * Added warning for WAL in pg_tde_create_key_using_global_key_provider In general: * Removed all logical replication mentions except the FAQ and in RC2 release note.
- added openbao topic and toc update for new file - content based on vault.md descriptions
Key deletion fucntions don't delete anything as keys stored in external key management system. So these functions just remove keys from TDE.
reverted the revert for set key changes for architecture, functions, set principal key and multi-tenant-setup.md
Updated the introduction with the proper extension name, updated the intro to reflect this. Removed important note about not meant for production and added the No upgrade warning from previous versions (like RC2) to GA. Updates: * removed the block announcement for RC2 at the top of the HTML page in the intro * Added the warning note before installation begins too. * Updated site name to full name.
Updated the Architecture topic with the following: - New intro detailing the long term tde goals in a paragraph - Updated the ## Typical setup scenarios topic with better writing and improved flow - Added note to WAL Encryption that it is not to be used in prod env - General small fixes to paragraphs, wrongly written words and such
Added initial files and modifications to include 1.0 release notes to the TOC and variables. Updates: * updated the ToC names to make them in line with style guide * updated variable with new release branch and fixed small release note name * updated ## Release Highlights with topics: * Added tickets * Updated Upgrade considerations
nastena1606
temporarily deployed
to
release-17.5.2 - INTERNAL-pg_tde docs PR #463
Render
Destroyed
jeltz
approved these changes
Jul 3, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.