Details
-
Improvement
-
Status: Done
-
High
-
Resolution: Fixed
-
None
-
None
-
None
Description
It should be possible to specify ENCRYPTION_KEY_ID for a tablespace.
It should not be allowed to create general tablespace with KEYRING encryption. For encrypting tablespace with key from keyring user should use encryption threads.
The original implementation from MariaDB also only allows to encrypt tablespaces with encryption threads (there is no notion of ENCRYPTION='KEYRING').
This will affect PS-5817. In this ticket we say that default-table-encryption can be set to KEYRING_ON. When set it means that general tablespace should be created with DEFAULT ENCRYPTION='KEYRING'. However, we will not be supporting ENCRYPTION='KEYRING' for general tablespaces. In first releases we might not want to implement PS-5817 and restrict default-table-encryption to ON/OFF/ONLINE_TO_KEYRING/ONLINE_FROM_KEYRING_TO_UNENCRYPTED. This is still to be decided and I will link Jira ticket with conclusion once we have one.