encryption-at-rest: Update

[dveeden]

What is changed, added or deleted? (Required)

Updating "Encryption at Rest" docs:

• Add note about using AWS KMS for on-premise deployment
• Add notes about key creation (e.g. to use the right key type)
• Fix the syntax of the encryption section configuration
• Add note about VPC endpoints for KMS
• Add note about multi-Region keys
• Add information about data-at-rest support in PD ( Support Transparent Data Encryption(TDE) for PD tidb#18262 )
• Remove some of the references to pre-v5.0 versions ( encryption-at-rest: Update #6152 (comment) )
• Use 168h instead of 7d as PD doesn't support d as unit specifier. ( data-key-rotation-period doesn't accept duration in days. tikv/pd#3987 )
• Added a note about EBS Encryption

Which TiDB version(s) do your changes apply to? (Required)

• master (the latest development version)
• v5.1 (TiDB 5.1 versions)
• v5.0 (TiDB 5.0 versions)
• v4.0 (TiDB 4.0 versions)
• v3.1 (TiDB 3.1 versions)
• v3.0 (TiDB 3.0 versions)
• v2.1 (TiDB 2.1 versions)

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• TomShawn

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[dveeden]

@TomShawn should we remove all reference to specific 4.x versions in master? I think that makes it easier to read etc.

[dveeden]

This suggests PD might support TDE, but I can't find anything about that in the docs.

mysql> show config where Name like 'security.encryption.%';
+------+-----------------+-------------------------------------------------------+--------------------------------------+
| Type | Instance        | Name                                                  | Value                                |
+------+-----------------+-------------------------------------------------------+--------------------------------------+
| pd   | 127.0.0.1:2379  | security.encryption.data-encryption-method            | plaintext                            |
| pd   | 127.0.0.1:2379  | security.encryption.data-key-rotation-period          | 168h0m0s                             |
| pd   | 127.0.0.1:2379  | security.encryption.master-key.endpoint               |                                      |
| pd   | 127.0.0.1:2379  | security.encryption.master-key.key-id                 |                                      |
| pd   | 127.0.0.1:2379  | security.encryption.master-key.path                   |                                      |
| pd   | 127.0.0.1:2379  | security.encryption.master-key.region                 |                                      |
| pd   | 127.0.0.1:2379  | security.encryption.master-key.type                   | plaintext                            |
| tikv | 127.0.0.1:20160 | security.encryption.data-encryption-method            | aes256-ctr                           |
| tikv | 127.0.0.1:20160 | security.encryption.data-key-rotation-period          | 1d                                   |
| tikv | 127.0.0.1:20160 | security.encryption.enable-file-dictionary-log        | true                                 |
| tikv | 127.0.0.1:20160 | security.encryption.file-dictionary-rewrite-threshold | 1000000                              |
| tikv | 127.0.0.1:20160 | security.encryption.master-key.endpoint               |                                      |
| tikv | 127.0.0.1:20160 | security.encryption.master-key.key-id                 | e857425b-6a5f-41df-a56f-6bcdb0fffd14 |
| tikv | 127.0.0.1:20160 | security.encryption.master-key.region                 | eu-central-1                         |
| tikv | 127.0.0.1:20160 | security.encryption.master-key.type                   | kms                                  |
| tikv | 127.0.0.1:20160 | security.encryption.master-key.vendor                 |                                      |
| tikv | 127.0.0.1:20160 | security.encryption.previous-master-key.type          | plaintext                            |
+------+-----------------+-------------------------------------------------------+--------------------------------------+
17 rows in set (0.01 sec)

This seems to be linked to pingcap/tidb#18262.

@yiwu-arbug any reason why this should not be in the docs? Maybe with a note about this being experimental?

[TomShawn]

@TomShawn should we remove all reference to specific 4.x versions in master? I think that makes it easier to read etc.

Yes. Of course.

[yiwu-arbug]

rest LGTM

[yiwu-arbug]

LGTM

[ti-chi-bot]

@yiwu-arbug: Thanks for your review. The bot only counts approvals from reviewers and higher roles in list, but you're still welcome to leave your comments.

In response to this:

LGTM

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

[TomShawn]

Rest LGTM

[TomShawn]

/verify

[TomShawn]

/remove-status LGT1
/status LGT2

[TomShawn]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: 3ffecb6

[ti-chi-bot]

In response to a cherrypick label: new pull request created: #6448.