Add support for restoring encrypted backup - #2359
Open
yashdaga-24 wants to merge 3 commits into
Open
Conversation
yashdaga-24
requested review from
egegunes,
eleo007,
gkech,
hors,
jvpasinatto,
mayankshah1607,
nmarukovich,
oksana-grishchenko,
pooknull and
valmiranogueira
as code owners
February 9, 2026 15:28
|
|
egegunes
requested changes
Feb 10, 2026
egegunes
left a comment
egegunes
left a comment
Contributor
There was a problem hiding this comment.
I see a lot of unrelated changes. @yashdaga-24 could you please rebase your branch to main? And please add a description of your changes.
Author
|
Hi @egegunes, Sorry I hadn't meant to raise it for review, I just raised it to share the changes to someone from our team. I'll break this and raise 2 separate PRs 1)Add extraPVC to restore pod. From my understanding currently keyring component is only handled for vault and not for file based and that too for pxc>=8.4. So I wanted to ask if you would want to merge the second PR? |
Contributor
I don't see any reason to not merge it. @hors wdyt? But please keep in mind that we have two different backup implementations: SST and XtrabackupSidecar. This needs to be implemented in both. |
yashdaga-24
force-pushed
the
add-support-for-restoring-encrypted-backup
branch
from
February 10, 2026 06:35
1d3d2eb to
e2b445c
Compare
- Add auto-detection for component keyring configs in recovery scripts
- Check for component_keyring_file.cnf in addition to vault config
- Detect component vs plugin based on config file content ("path" key for component, "vault_url" for plugin)
- Support XtraBackup 8.0.25+ with component-based keyring
- Support XtraBackup 8.4.0+ which always uses components
yashdaga-24
force-pushed
the
add-support-for-restoring-encrypted-backup
branch
from
February 10, 2026 06:51
e2b445c to
854cf21
Compare
Author
Collaborator
commit: d9921a6 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGE DESCRIPTION
Problem:
Restore operations fail when backups contain tables encrypted using file-based keyring components (component_keyring_file). The recovery scripts only support vault-based keyring configurations and do not detect or handle file-based keyring component configurations, causing restore and prepare jobs to fail with keyring-related errors.
Cause:
Short explanation of the root cause of the issue if applicable.
Solution:
Update the recovery scripts to properly detect and support file-based keyring components:
Component mode: --component-keyring-config
Plugin mode: --keyring-vault-config with --early-plugin-load
CHECKLIST
Jira
Needs Doc) and QA (Needs QA)?Tests
compare/*-oc.yml)?Config/Logging/Testability