Buy Percona ServicesBuy Now!

Please tell me an upgrade howto / path for table encrypted PXC v. 5.7.25

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Please tell me an upgrade howto / path for table encrypted PXC v. 5.7.25

    Hello,

    I am running a version PXC cluster on Ubuntu 18.04 LTS servers since a year+. I've regularly updated it so that at the moment it shows the following version manifest:

    Code:
    Server version: 5.7.25-28-57-log Percona XtraDB Cluster (GPL), Release rel28, Revision a2ef85f, WSREP version 31.35, wsrep_31.35
    Galera version 3.35(rddf9876)

    Relevant configuration settings:

    Code:
    innodb_file_per_table=ON
    early-plugin-load="keyring_vault=keyring_vault.so"
    keyring_vault_config="/var/lib/mysql-keyring/keyring_vault.conf"
    keyring-vault-timeout=30
    innodb_encrypt_tables=ON
    innodb_temp_tablespace_encrypt=ON
    binlog_checksum=CRC32
    master_verify_checksum=ON

    As you can see from the above config snippet, it's running the keyring vault plugin, connected to an HashiCorp Vault server and it's setup for tables based encryption.

    Tables have been encrypted with:

    Code:
    ALTER TABLE `table_name` ENCRYPTION='Y'
    Everything works perfectly.

    However, I cannot upgrade this setup any more.

    I can shut down the cluster and upgrade the servers one by one, if needed. I have no "100% uptime" requirement.

    Every time I perform a:

    Code:
    apt update
    apt dist-upgrade
    the existing PXC gets upgraded and... stops starting any more.
    The log states that encrypted tables are not supported.

    The plugin and vault server communication work, I have double checked them by hand on the command line.
    Plus, when I restore the server(s) image backup, everything works again.

    I have read somewhere on Percona's website that newer PXC versions don't support table based encryption.

    Is it true?
    If so, how do I upgrade PXC to a current version?
    I don't need to switch to version 8, just to upgrade to the most recent 5.XX version.

    Best regards,
    Dario Fumagalli
Working...
X