|
| 1 | +# pg_tde 1.0 ({{date.GA10}}) |
| 2 | + |
| 3 | +The `pg_tde` by Percona extension brings in [Transparent Data Encryption (TDE)](../index/index.md) to PostgreSQL and enables you to keep sensitive data safe and secure. |
| 4 | + |
| 5 | +[Get Started](../install.md){.md-button} |
| 6 | + |
| 7 | +## Release Highlights |
| 8 | + |
| 9 | +* **`pg_tde` 1.0 is now GA (Generally Available)** |
| 10 | + |
| 11 | +And **stable** for encrypting relational data in PostgreSQL using [Transparent Data Encryption (TDE)](../index/index.md). This milestone brings production-level data protection to PostgreSQL workloads. |
| 12 | + |
| 13 | +* **WAL encryption is still in Beta** |
| 14 | + |
| 15 | +The WAL encryption feature is currently still in beta and is not effective unless explicitly enabled. **It is not yet production ready.** Do **not** enable this feature in production environments. |
| 16 | + |
| 17 | +## Upgrade considerations |
| 18 | + |
| 19 | +`pg_tde` {{tdeversion}} is **not** backward compatible with previous `pg_tde` versions, like Release Candidate 2, due to significant changes in code. This means you **cannot** directly upgrade from one version to another. You must do **a clean installation** of `pg_tde`. |
| 20 | + |
| 21 | +## Known issues |
| 22 | + |
| 23 | +* The default `mlock` limit on Rocky Linux 8 for ARM64-based architectures equals the memory page size and is 64 Kb. This results in the child process with `pg_tde` failing to allocate another memory page because the max memory limit is reached by the parent process. |
| 24 | + |
| 25 | +To prevent this, you can change the `mlock` limit to be at least twice bigger than the memory page size: |
| 26 | + |
| 27 | +* temporarily for the current session using the `ulimit -l <value>` command. |
| 28 | +* set a new hard limit in the `/etc/security/limits.conf` file. To do so, you require the superuser privileges. |
| 29 | + |
| 30 | +Adjust the limits with caution since it affects other processes running in your system. |
| 31 | + |
| 32 | +## Changelog |
| 33 | + |
| 34 | +### New Features |
| 35 | + |
| 36 | +- [PG-1257](https://perconadev.atlassian.net/browse/PG-1257) – Added SQL function to remove the current principal key |
| 37 | + |
| 38 | +### Improvements |
| 39 | + |
| 40 | +- [PG-1617](https://perconadev.atlassian.net/browse/PG-1617) – Removed relation key cache |
| 41 | +- [PG-1635](https://perconadev.atlassian.net/browse/PG-1635) – User-facing TDE functions now return void |
| 42 | +- [PG-1605](https://perconadev.atlassian.net/browse/PG-1605) – Removed undeclared dependencies for `pg_tde_grant_database_key_management_to_role()` |
| 43 | + |
| 44 | +### Bugs Fixed |
| 45 | + |
| 46 | +- [PG-1581](https://perconadev.atlassian.net/browse/PG-1581) – Fixed PostgreSQL crashes on table access when KMIP key is unavailable after restart |
| 47 | +- [PG-1583](https://perconadev.atlassian.net/browse/PG-1583) – Fixed a crash when dropping the `pg_tde` extension with CASCADE after changing the key provider file |
| 48 | +- [PG-1585](https://perconadev.atlassian.net/browse/PG-1585) – Fixed the vault provider re-addition that failed after server restart with a new token |
| 49 | +- [PG-1592](https://perconadev.atlassian.net/browse/PG-1592) – Improve error logs when Server Key Info is requested without being created |
| 50 | +- [PG-1593](https://perconadev.atlassian.net/browse/PG-1593) – Fixed runtime failures when invalid Vault tokens are allowed during key provider creation |
| 51 | +- [PG-1600](https://perconadev.atlassian.net/browse/PG-1600) – Fixed Postmaster error when dropping a table with an unavailable key provider |
| 52 | +- [PG-1606](https://perconadev.atlassian.net/browse/PG-1606) – Fixed missing superuser check in role grant function leads to misleading errors |
| 53 | +- [PG-1607](https://perconadev.atlassian.net/browse/PG-1607) – Improved CA parameter order and surrounding documentation for clearer interpretation |
| 54 | +- [PG-1608](https://perconadev.atlassian.net/browse/PG-1608) – Updated and fixed global key configuration parameters in documentation |
| 55 | +- [PG-1613](https://perconadev.atlassian.net/browse/PG-1613) – Tested and improved the `pg_tde_change_key_provider` CLI utility |
| 56 | +- [PG-1637](https://perconadev.atlassian.net/browse/PG-1637) – Fixed unused keys in key files which caused issues after OID wraparound |
| 57 | +- [PG-1651](https://perconadev.atlassian.net/browse/PG-1651) – Fixed the CLI tool when working with Vault key export/import |
| 58 | +- [PG-1652](https://perconadev.atlassian.net/browse/PG-1652) – Fixed when the server fails to find encryption keys after CLI-based provider change |
| 59 | +- [PG-1662](https://perconadev.atlassian.net/browse/PG-1662) – Fixed the creation of inconsistent encryption status when altering partitioned tables |
| 60 | +- [PG-1663](https://perconadev.atlassian.net/browse/PG-1663) – Fixed the indexes on partitioned tables which were not encrypted |
| 61 | +- [PG-1700](https://perconadev.atlassian.net/browse/PG-1700) – Fixed the error hint when the principal key is missing |
0 commit comments