PG-1870 Run postgresql TAP suite with pg_tde enabled #535

AndersAstrand · 2025-08-14T12:02:15Z

This enables wal encryption and table encryption by default when running postgres TAP suite with TDE_MODE=1.

A few tests had to be skipped for various reasons, and some of these should most likely be looked into as they might be actual bugs or test setup issues we can fix.

Use TDE_MODE=1 to enable pg_tde with both wal and relation encryption. Use TDE_MODE_WAL=0 to disable wal encryption and TDE_MODE_SMGR=0 to disable relation encryption.

For example to run the postgres suite with WAL encryption turned on, but not SMGR:
TDE_MODE=1 TDE_MODE_SMGR=0 meson test --no-suite pg_tde

There is also TDE_MODE_NOSKIP=1 which will force all tests to run. This is useful when investigating the test failures that made it necessary to skip some tests.

src/test/perl/PostgreSQL/Test/TdeCluster.pm

jeltz

Looks good, especially with Zsolt's proposed changes if they can be implemented reaosnably which generates the files and copies them.

src/test/perl/PostgreSQL/Test/TdeCluster.pm

codecov-commenter · 2025-08-15T09:50:09Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.22%. Comparing base (415cb8d) to head (d976449).

❌ Your project status has failed because the head coverage (82.22%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@                Coverage Diff                 @@
##           TDE_REL_17_STABLE     #535   +/-   ##
==================================================
  Coverage              82.22%   82.22%           
==================================================
  Files                     25       25           
  Lines                   3246     3246           
  Branches                 512      512           
==================================================
  Hits                    2669     2669           
  Misses                   465      465           
  Partials                 112      112

Components	Coverage Δ
access	`84.70% <ø> (ø)`
catalog	`87.65% <ø> (ø)`
common	`77.77% <ø> (ø)`
encryption	`72.97% <ø> (ø)`
keyring	`73.21% <ø> (ø)`
src	`94.18% <ø> (ø)`
smgr	`96.53% <ø> (ø)`
transam	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

src/bin/pg_basebackup/t/010_pg_basebackup.pl

jeltz

Nice changes! Nice also to see some use of single user mode.

jeltz · 2025-08-26T10:08:42Z

src/test/perl/PostgreSQL/Test/TdeCluster.pm

+	my ($self) = @_;
+
+	my $tde_template_dir = $ENV{TDE_TEMPLATE_DIR}
+	  if defined($ENV{TDE_TEMPLATE_DIR});


Is there a reason we have not implemented it for make? Just lack of time? The reason should either be in the commit message or a comment.

I just didn't care enough about make to do it. Which is probably not a great reason. I am honestly on the fence if we should do it for meson either. Might not be worth the extra complexity.

I can't say I care either way but it should be explained in the commit message.

Have you emasured the speedup?

I have a hard time doing any type of even preliminary performance testing on my laptop right now because the stupid s1-agent eats so much CPU and it's quite random.

I'm not sure what more to say about i in a commit message. I already mention that it does it for meson but not for make. Should I just remove it from meson if it's confusing?

Or do you mean that I should mention that there is no technical reason for not doing it in make, just that this commit doesn't do that?

Or do you mean that I should mention that there is no technical reason for not doing it in make, just that this commit doesn't do that?

Yes, that is what I meant.

Or do you mean that I should mention that there is no technical reason for not doing it in make, just that this commit doesn't do that?

Yes, that is what I meant.

Pushed new version of the branch that does the meson setup in a separate commit with a more verbose commit message.

src/bin/pg_rewind/t/001_basic.pl

src/test/perl/PostgreSQL/Test/TdeCluster.pm

This makes sure pg_tde is loaded and keys are setup when running postgresql TAP suite. No TDE features are enabled at this point. Single user mode is used to generate a template of pg_tde setup files which are then copied to each created cluster's data directory.

This enables WAL encryption by default when the TAP tests are run with TDE_MODE=1. Use TDE_MODE_WAL=0 to disable wal encryption while still having pg_tde enabled.

This enables table encryption by default in TAP tests when TDE_MODE=1. Use TDE_MODE_SMGR=0 to turn off table encryption when running with pg_tde loaded. The setup for running regress with tde turned on has been slightly modified to match what is done for TAP tests to let tests that run the regress suite under TAP work.

This is currently only added for meson, but could also be added for make. This has to be setup before the actual TAP tests are run as they are run in parallel and as such would all try to setup the template at the same time if we let them use the same folder for it without it being pre-generated. This seems to shorten the test suite run-time by ~25% on my laptop, so it seems worth doing.

dutow reviewed Aug 14, 2025

View reviewed changes

src/test/perl/PostgreSQL/Test/TdeCluster.pm Outdated Show resolved Hide resolved

jeltz reviewed Aug 14, 2025

View reviewed changes

src/test/perl/PostgreSQL/Test/TdeCluster.pm Outdated Show resolved Hide resolved

src/test/perl/PostgreSQL/Test/TdeCluster.pm Outdated Show resolved Hide resolved

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch from 3aac647 to 0e93481 Compare August 15, 2025 09:44

AndersAstrand mentioned this pull request Aug 15, 2025

Add recovery TAP test for pg_tde #528

Closed

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch 11 times, most recently from 615c60f to 4ccb15e Compare August 20, 2025 08:26

dutow force-pushed the TDE_REL_17_STABLE branch from b3b7e89 to 415cb8d Compare August 20, 2025 08:59

dAdAbird reviewed Aug 20, 2025

View reviewed changes

src/bin/pg_basebackup/t/010_pg_basebackup.pl Outdated Show resolved Hide resolved

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch from 4ccb15e to cdd6aa1 Compare August 25, 2025 11:02

AndersAstrand marked this pull request as ready for review August 25, 2025 11:06

AndersAstrand changed the title ~~Run postgresql TAP suite with WAL encryption enabled~~ PG-1870 Run postgresql TAP suite with WAL encryption enabled Aug 25, 2025

AndersAstrand changed the base branch from TDE_REL_17_STABLE to release-17.5.3 August 25, 2025 11:11

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch from cdd6aa1 to 3647e68 Compare August 25, 2025 13:34

AndersAstrand changed the title ~~PG-1870 Run postgresql TAP suite with WAL encryption enabled~~ PG-1870 Run postgresql TAP suite with pg_tde enabled Aug 25, 2025

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch from 3647e68 to 512a3a1 Compare August 25, 2025 14:55

AndersAstrand changed the base branch from release-17.5.3 to TDE_REL_17_STABLE August 26, 2025 09:40

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch from 512a3a1 to 82e6728 Compare August 26, 2025 09:41

jeltz requested changes Aug 26, 2025

View reviewed changes

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch 2 times, most recently from 8d7f347 to c757bde Compare August 28, 2025 15:31

AndersAstrand added 4 commits August 28, 2025 17:36

PG-1870 Enable WAL encryption in TAP tests

7a5ac66

This enables WAL encryption by default when the TAP tests are run with TDE_MODE=1. Use TDE_MODE_WAL=0 to disable wal encryption while still having pg_tde enabled.

AndersAstrand force-pushed the tde/run-postgres-tap-tests-with-wal-encryption branch from c757bde to d976449 Compare August 28, 2025 15:37

jeltz approved these changes Aug 28, 2025

View reviewed changes

AndersAstrand merged commit ffb828f into percona:TDE_REL_17_STABLE Aug 28, 2025
19 checks passed

AndersAstrand deleted the tde/run-postgres-tap-tests-with-wal-encryption branch August 28, 2025 15:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

PG-1870 Run postgresql TAP suite with pg_tde enabled #535

PG-1870 Run postgresql TAP suite with pg_tde enabled #535

AndersAstrand commented Aug 14, 2025 •

edited

Loading

Uh oh!

Uh oh!

jeltz left a comment

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Aug 15, 2025 •

edited

Loading

Uh oh!

Uh oh!

jeltz left a comment

Uh oh!

jeltz Aug 26, 2025

Uh oh!

AndersAstrand Aug 26, 2025

Uh oh!

jeltz Aug 26, 2025

Uh oh!

jeltz Aug 26, 2025

Uh oh!

AndersAstrand Aug 26, 2025

Uh oh!

AndersAstrand Aug 27, 2025 •

edited

Loading

Uh oh!

jeltz Aug 28, 2025

Uh oh!

AndersAstrand Aug 28, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PG-1870 Run postgresql TAP suite with pg_tde enabled #535

PG-1870 Run postgresql TAP suite with pg_tde enabled #535

Conversation

AndersAstrand commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jeltz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

jeltz left a comment

Choose a reason for hiding this comment

Uh oh!

jeltz Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

AndersAstrand Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

jeltz Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

jeltz Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

AndersAstrand Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

AndersAstrand Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeltz Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

AndersAstrand Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AndersAstrand commented Aug 14, 2025 •

edited

Loading

codecov-commenter commented Aug 15, 2025 •

edited

Loading

AndersAstrand Aug 27, 2025 •

edited

Loading