br: add doc for log backup encryption #18650

Tristan1900 · 2024-09-14T16:53:10Z

First-time contributors' checklist

I've signed Contributor License Agreement that's required for repo owners to accept my contribution.

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

Tips for choosing the affected version(s):

By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.

For details, see tips for choosing the affected versions (in Chinese).

What is the related PR or file link(s)?

This PR is translated from: br: add log for local encryption docs#18906
Other reference link(s):

Do your changes match any of the following descriptions?

Delete files
Change aliases
Need modification after applied to another branch
Might cause conflicts after applied to another branch

CLAassistant · 2024-09-14T16:53:16Z

All committers have signed the CLA.

ti-chi-bot · 2024-09-19T15:12:42Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from qiancai, ensuring that each of them provides their approval before proceeding. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

qiancai · 2024-09-24T09:34:58Z

br/br-pitr-manual.md

@@ -87,6 +87,64 @@ tiup br log start --task-name=pitr --pd="${PD_IP}:2379" \
 --storage='s3://backup-101/logbackup?access-key=${access-key}&secret-access-key=${secret-access-key}"'
 ```

+### 日志数据备份加密


Suggested change

### 日志数据备份加密

### 加密日志备份数据

ti-chi-bot · 2024-09-24T23:48:38Z

@BornChanger: adding LGTM is restricted to approvers and reviewers in OWNERS files.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

qiancai · 2024-09-26T03:43:45Z

br/br-pitr-manual.md

+
+> **警告：**
+>
+> 当前该功能为实验特性，不建议在生产环境中使用。


Suggested change

> 当前该功能为实验特性，不建议在生产环境中使用。

> 当前该功能为实验特性，不建议在生产环境中使用。该功能可能会在未事先通知的情况下发生变化或删除。如果发现 bug，请在 GitHub 上提 [issue](https://github.com/pingcap/tidb/issues) 反馈。

qiancai · 2024-09-26T03:48:50Z

br/br-pitr-manual.md

+
+BR 支持在上传到备份存储之前对日志备份数据进行加密。
+
+自 TiDB v8.4.0 起，你可以通过直接传入数据密钥配置参数来加密日志备份数据，类似于快照备份加密：


Suggested change

自 TiDB v8.4.0 起，你可以通过直接传入数据密钥配置参数来加密日志备份数据，类似于快照备份加密：

自 TiDB v8.4.0 起，你可以在日志备份命令中传入以下参数来加密日志备份数据，类似于[快照备份加密](/br/br-snapshot-manual.md#备份数据加密)：

qiancai · 2024-09-26T03:53:18Z

br/br-pitr-manual.md

+--master-key-crypter-method：用于加密日志备份文件的加密算法，可以是 aes128-ctr、aes192-ctr 或 aes256-ctr。默认值为 plaintext。
+--master-key：主密钥配置。可以是基于本地磁盘的主密钥或基于云 KMS 的主密钥。


Suggested change

--master-key-crypter-method：用于加密日志备份文件的加密算法，可以是 aes128-ctr、aes192-ctr 或 aes256-ctr。默认值为 plaintext。

--master-key：主密钥配置。可以是基于本地磁盘的主密钥或基于云 KMS 的主密钥。

`--master-key-crypter-method`：基于主密钥的加密算法，支持 `aes128-ctr`、`aes192-ctr` 和 `aes256-ctr` 三种算法，缺省值为 `plaintext`，表示不加密

`--master-key`：主密钥配置，可以是基于本地磁盘的主密钥或基于云 KMS 的主密钥

qiancai · 2024-09-26T03:55:40Z

br/br-pitr-manual.md

+
+> **警告：**
+>
+> 当前该功能为实验特性，不建议在生产环境中使用。


Suggested change

> 当前该功能为实验特性，不建议在生产环境中使用。

> 当前该功能为实验特性，不建议在生产环境中使用。该功能可能会在未事先通知的情况下发生变化或删除。如果发现 bug，请在 GitHub 上提 [issue](https://github.com/pingcap/tidb/issues) 反馈。

qiancai · 2024-09-26T04:04:58Z

br/br-pitr-manual.md

+ --log.crypter.key 0123456789abcdef0123456789abcdef
+```
+
+然而，在更严格的加密场景中，你可能不希望在命令行中传入固定的加密密钥。相反，你可以使用基于主密钥的加密系统来管理加密密钥。基于主密钥的加密使用不同的数据密钥来加密不同的日志备份文件，并且支持主密钥轮换。


Suggested change

然而，在更严格的加密场景中，你可能不希望在命令行中传入固定的加密密钥。相反，你可以使用基于主密钥的加密系统来管理加密密钥。基于主密钥的加密使用不同的数据密钥来加密不同的日志备份文件，并且支持主密钥轮换。

然而，在一些对安全性要求更高的场景中，你可能不希望在命令行中直接传入固定的加密密钥。为了进一步提高安全性，你可以使用基于主密钥的加密系统来管理加密密钥。该系统会使用不同的数据密钥来加密不同的日志备份文件，并且支持主密钥轮换。

qiancai · 2024-09-26T04:22:06Z

br/br-pitr-manual.md

+--log.crypter.key 0123456789abcdef0123456789abcdef
+```
+
+如果你使用主密钥加密进行日志备份，则可以使用以下命令：


Suggested change

如果你使用主密钥加密进行日志备份，则可以使用以下命令：

如果日志备份是通过主密钥加密的，则可以使用以下命令进行解密恢复：

qiancai · 2024-09-26T08:10:59Z

br/br-pitr-manual.md

+>
+> 当前该功能为实验特性，不建议在生产环境中使用。
+
+在对数据进行加密备份后，恢复操作需要传入相应的解密参数。如果解密算法或密钥不正确，则无法恢复数据。解密参数需要与加密时使用的参数一致。解密恢复的示例如下：


Suggested change

在对数据进行加密备份后，恢复操作需要传入相应的解密参数。如果解密算法或密钥不正确，则无法恢复数据。解密参数需要与加密时使用的参数一致。解密恢复的示例如下：

要恢复加密的日志备份数据，你需要在恢复命令中传入相应的解密参数。解密参数需要与加密时使用的参数一致。如果解密算法或密钥不正确，则无法恢复数据。

示例如下：

qiancai · 2024-09-26T08:22:43Z

br/br-pitr-manual.md

+- `--log.crypter.key`：加密密钥，十六进制字符串格式，`aes128-ctr` 对应 128 位（16 字节）密钥长度，`aes192-ctr` 为 24 字节，`aes256-ctr` 为 32 字节
+- `--log.crypter.key-file`：密钥文件，可直接将存放密钥的文件路径作为参数传入，此时 `log.crypter.key` 不需要配置
+
+备份加密的示例如下：


Suggested change

备份加密的示例如下：

示例如下：

Tristan1900 · 2024-09-26T14:30:20Z

@qiancai thanks for the suggestions! I have applied them locally and pushed. It's weird when I click the commit suggestion button on the GitHub UI it will fail with email not correct error...

Tristan1900 · 2024-09-26T20:36:08Z

/retest

br/br-pitr-manual.md

ti-chi-bot · 2024-09-27T02:11:59Z

@Tristan1900: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-verify	`dbd1262`	link	true	`/test pull-verify`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

ti-chi-bot · 2024-09-27T06:21:09Z

[LGTM Timeline notifier]

Timeline:

2024-09-27 06:21:09.159879406 +0000 UTC m=+1806138.900303343: ☑️ agreed by qiancai.

ti-chi-bot bot added the first-time-contributor Indicates that the PR was contributed by an external member and is a first-time contributor. label Sep 14, 2024

ti-chi-bot bot added missing-translation-status This PR does not have translation status info. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 14, 2024

Oreoxmt assigned qiancai Sep 18, 2024

Oreoxmt requested a review from qiancai September 18, 2024 05:48

Oreoxmt added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. v8.4 This PR/issue applies to TiDB v8.4. translation/done This PR has been translated from English into Chinese and updated to pingcap/docs-cn in a PR. labels Sep 18, 2024

ti-chi-bot bot removed the missing-translation-status This PR does not have translation status info. label Sep 18, 2024

qiancai requested a review from BornChanger September 18, 2024 07:55

ti-chi-bot bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 19, 2024

qiancai added translation/from-docs This PR is translated from a PR in pingcap/docs. and removed translation/done This PR has been translated from English into Chinese and updated to pingcap/docs-cn in a PR. labels Sep 24, 2024

qiancai reviewed Sep 24, 2024

View reviewed changes

BornChanger approved these changes Sep 24, 2024

View reviewed changes

qiancai reviewed Sep 26, 2024

View reviewed changes

ti-chi-bot bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 26, 2024

qiancai reviewed Sep 27, 2024

View reviewed changes

br/br-pitr-manual.md Outdated Show resolved Hide resolved

br/br-pitr-manual.md Outdated Show resolved Hide resolved

Tristan1900 added 3 commits September 26, 2024 21:45

add doc for log backup encryption

ba78f63

fix typo

ae3fbb1

fix format

c1946ab

Tristan1900 added 7 commits September 26, 2024 21:45

one more format fix

9d2ff0b

remove index

4755734

address comments

5a69b8d

address comments

ab38bb3

line break

10583b3

fix format?

c697f1e

address comments and fix style

9cc6f49

Tristan1900 force-pushed the add-local-encryption-doc branch from 7cde23f to 9cc6f49 Compare September 27, 2024 01:45

qiancai reviewed Sep 27, 2024

View reviewed changes

br/br-pitr-manual.md Outdated Show resolved Hide resolved

qiancai reviewed Sep 27, 2024

View reviewed changes

br/br-pitr-manual.md Outdated Show resolved Hide resolved

format udpates

dbd1262

qiancai approved these changes Sep 27, 2024

View reviewed changes

ti-chi-bot bot added the needs-1-more-lgtm Indicates a PR needs 1 more LGTM. label Sep 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

br: add doc for log backup encryption #18650

br: add doc for log backup encryption #18650

Tristan1900 commented Sep 14, 2024 •

edited by qiancai

Loading

CLAassistant commented Sep 14, 2024 •

edited

Loading

ti-chi-bot bot commented Sep 19, 2024

qiancai Sep 24, 2024 •

edited

Loading

ti-chi-bot bot commented Sep 24, 2024

qiancai Sep 26, 2024

qiancai Sep 26, 2024

qiancai Sep 26, 2024

qiancai Sep 26, 2024

qiancai Sep 26, 2024

qiancai Sep 26, 2024

qiancai Sep 26, 2024 •

edited

Loading

qiancai Sep 26, 2024

Tristan1900 commented Sep 26, 2024

Tristan1900 commented Sep 26, 2024

ti-chi-bot bot commented Sep 27, 2024

ti-chi-bot bot commented Sep 27, 2024

	> 当前该功能为实验特性，不建议在生产环境中使用。
	> 当前该功能为实验特性，不建议在生产环境中使用。该功能可能会在未事先通知的情况下发生变化或删除。如果发现 bug，请在 GitHub 上提 [issue](https://github.com/pingcap/tidb/issues) 反馈。


		BR 支持在上传到备份存储之前对日志备份数据进行加密。

		自 TiDB v8.4.0 起，你可以通过直接传入数据密钥配置参数来加密日志备份数据，类似于快照备份加密：

	自 TiDB v8.4.0 起，你可以通过直接传入数据密钥配置参数来加密日志备份数据，类似于快照备份加密：
	自 TiDB v8.4.0 起，你可以在日志备份命令中传入以下参数来加密日志备份数据，类似于[快照备份加密](/br/br-snapshot-manual.md#备份数据加密)：

		--master-key-crypter-method：用于加密日志备份文件的加密算法，可以是 aes128-ctr、aes192-ctr 或 aes256-ctr。默认值为 plaintext。
		--master-key：主密钥配置。可以是基于本地磁盘的主密钥或基于云 KMS 的主密钥。

	然而，在更严格的加密场景中，你可能不希望在命令行中传入固定的加密密钥。相反，你可以使用基于主密钥的加密系统来管理加密密钥。基于主密钥的加密使用不同的数据密钥来加密不同的日志备份文件，并且支持主密钥轮换。
	然而，在一些对安全性要求更高的场景中，你可能不希望在命令行中直接传入固定的加密密钥。为了进一步提高安全性，你可以使用基于主密钥的加密系统来管理加密密钥。该系统会使用不同的数据密钥来加密不同的日志备份文件，并且支持主密钥轮换。

	如果你使用主密钥加密进行日志备份，则可以使用以下命令：
	如果日志备份是通过主密钥加密的，则可以使用以下命令进行解密恢复：

br: add doc for log backup encryption #18650

Are you sure you want to change the base?

br: add doc for log backup encryption #18650

Conversation

Tristan1900 commented Sep 14, 2024 • edited by qiancai Loading

First-time contributors' checklist

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

Do your changes match any of the following descriptions?

CLAassistant commented Sep 14, 2024 • edited Loading

ti-chi-bot bot commented Sep 19, 2024

qiancai Sep 24, 2024 • edited Loading

Choose a reason for hiding this comment

ti-chi-bot bot commented Sep 24, 2024

qiancai Sep 26, 2024

Choose a reason for hiding this comment

qiancai Sep 26, 2024

Choose a reason for hiding this comment

qiancai Sep 26, 2024

Choose a reason for hiding this comment

qiancai Sep 26, 2024

Choose a reason for hiding this comment

qiancai Sep 26, 2024

Choose a reason for hiding this comment

qiancai Sep 26, 2024

Choose a reason for hiding this comment

qiancai Sep 26, 2024 • edited Loading

Choose a reason for hiding this comment

qiancai Sep 26, 2024

Choose a reason for hiding this comment

Tristan1900 commented Sep 26, 2024

Tristan1900 commented Sep 26, 2024

ti-chi-bot bot commented Sep 27, 2024

ti-chi-bot bot commented Sep 27, 2024

[LGTM Timeline notifier]

Tristan1900 commented Sep 14, 2024 •

edited by qiancai

Loading

CLAassistant commented Sep 14, 2024 •

edited

Loading

qiancai Sep 24, 2024 •

edited

Loading

qiancai Sep 26, 2024 •

edited

Loading