test: Add TDE feature test #1273
Conversation
|
/run-integration-test |
tests/br_restore_TDE_enable/run.sh
Outdated
|
|
||
| # start Minio KMS service | ||
|
|
||
| export MINIO_KMS_KES_ENDPOINT=https://play.min.io:7373 |
There was a problem hiding this comment.
The KES instance at
https://play.min.io:7373is meant to experiment and provides a way to get started quickly.
Note that anyone can access or delete master keys athttps://play.min.io:7373. You should run your own KES instance in production.
is it possible the KMS become unavailable 🤔
There was a problem hiding this comment.
I have no idea, and I had built a KES instance based on filesystem keystore, the backup process will cause the following problem:
2021/07/08 17:25:23 http: TLS handshake error from 127.0.0.1:50530: remote error: tls: bad certificate
API: PutObject(bucket=mybucket, object=br_restore_TDE_enable/backup.lock)
Time: 17:25:23 CST 07/08/2021
DeploymentID: 62ea50fd-5f6e-4148-83b1-4a5d44dd14f2
RequestID: 168FC69289933DF3
RemoteHost: 127.0.0.1
Host: 127.0.0.1:24927
UserAgent: aws-sdk-go/1.35.3 (go1.16.5; linux; amd64)
Error: Post https://127.0.0.1:7391/v1/key/generate/my-minio-key: x509: certificate signed by unknown authority
4: cmd/api-errors.go:1786:cmd.toAPIErrorCode()
3: cmd/api-errors.go:1811:cmd.toAPIError()
2: cmd/object-handlers.go:1360:cmd.objectAPIHandlers.PutObjectHandler()
1: net/http/server.go:2007:http.HandlerFunc.ServeHTTP()
There was a problem hiding this comment.
@Zwj-coder is the KES server configured like https://github.com/minio/kes/wiki/Getting-Started#22-create-the-root-identity?
There was a problem hiding this comment.
It seems that the tikv node have not certification to access KES server.
There was a problem hiding this comment.
@kennytm I had replaced outside instance https://play.min.io:7373 with a self-made KES Server , the previous problem was caused by that KES Server not trust the self-signed certification, and we should explicitly set
export MINIO_KMS_KES_CA_PATH=<CA-or-KES-server-certificate>
|
/run-integration-test |
|
@kennytm CI problem fixed |
|
[REVIEW NOTIFICATION] This pull request has been approved by:
To complete the pull request process, please ask the reviewers in the list to review by filling The full list of commands accepted by this bot can be found here. Reviewer can indicate their review by submitting an approval review. |
|
/merge |
|
This pull request has been accepted and is ready to merge. Commit hash: 9975d81
|
|
In response to a cherrypick label: new pull request created: #1347. |
|
In response to a cherrypick label: new pull request created: #1348. |
|
In response to a cherrypick label: new pull request created: #1349. |
What problem does this PR solve?
close issure # 1265
Add integration test for backup and restore when TDE feature enable
What is changed and how it works?
Add test case in integration tests
Check List
Tests
Related changes
Release note