Skip to content

Commit 6868799

Browse files
ldecarvalho-docldecarvalho-doc
committed
fix(rdb): ear
1 parent 88732fb commit 6868799

File tree

3 files changed

+175
-0
lines changed

3 files changed

+175
-0
lines changed

‎managed-databases/postgresql-and-mysql/api-cli/setting-up-encryption-at-rest.mdx‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
meta:
3+
title: Setting up Encryption at Rest for your Managed Databases with the Scaleway API
4+
description: This page explains how to set up Encryption at Rest for your Managed Databases with the Scaleway API.
5+
content:
6+
h1: Setting up Encryption at Rest for your Managed Databases with the Scaleway API
7+
paragraph: This page explains how to set up Encryption at Rest for your Managed Databases with the Scaleway API.
8+
tags: managed-database postgresql mysql encryption at rest
9+
dates:
10+
validation: 2024-12-19
11+
posted: 2024-12-19
12+
categories:
13+
- managed-databases
14+
- postgresql-and-mysql
15+
---
16+
17+
Encryption at rest allows you to permanently encrypt your database data. The data is encrypted at volume level using [LUKS](https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup). The management of the encryption key is done by Scaleway.
18+
19+
The feature can be activated upon Database Instance creation via the console and the API, or after creation exclusively through the API with the [upgrade endpoint](https://www.scaleway.com/en/developers/api/managed-database-postgre-mysql/#path-database-instances-upgrade-a-database-instance).
20+
21+
<Message type="important">
22+
- Once activated on a Database Instance, encryption at rest cannot be disabled.
23+
- All databases, data (including logs), and snapshots will be encrypted. Logical backup encryption is not currently available.
24+
- Enabling encryption means your database data will be copied into a new, encrypted block volume. This takes approximately 1 hour per 100 GB of storage. When switching volumes, expect a few seconds of downtime towards the end of the copying process. Refer to the [Encryption at rest performance benchmark on Database Instances](/managed-databases/postgresql-and-mysql/reference-content/encryption-at-rest-performance-benchmark) page.
25+
</Message>
26+
27+
## Creating a Database Instance with encryption at rest
28+
29+
1. Edit the POST request payload you will use to create your Database Instance. Make sure you include the `encryption` parameter and set the `enabled` attribute to `true`.
30+
<Message type="note">
31+
In all examples below the UUIDs, passwords and IP addresses displayed are not real. For more details about the parameters shown, refer to the [Managed Databases for PostgreSQL and MySQL API documentation](https://www.scaleway.com/en/developers/api/managed-database-postgre-mysql/)
32+
</Message>
33+
34+
```json
35+
'{
36+
"project_id": "d8e65f2b-cce9-40b7-80fc-6a2902db6826",
37+
"name": "myDB",
38+
"engine": "PostgreSQL-15",
39+
"tags": ["donnerstag"],
40+
"is_ha_cluster": true,
41+
"node_type": "db-pro2-xxs",
42+
"disable_backup": false,
43+
"user_name": "my_initial_user",
44+
"password": "thiZ_is_v0ry_s3cret",
45+
"volume_type": "sbs_5k",
46+
"volume_size": "30000000000",
47+
"encryption": {
48+
"enabled": true
49+
}
50+
}'
51+
```
52+
53+
3. Create a Database Instance by running the following command. Make sure you include the payload you edited in the previous step.
54+
```bash
55+
curl -X POST \
56+
-H "X-Auth-Token: $SCW_SECRET_KEY" \
57+
"Content-Type: application/json" \
58+
https://api.scaleway.com/rdb/v1/regions/$SCW_REGION/instances \
59+
-d '{
60+
"project_id": "d8e65f2b-cce9-40b7-80fc-6a2902db6826",
61+
"name": "myDB",
62+
"engine": "PostgreSQL-15",
63+
"tags": ["donnerstag"],
64+
"is_ha_cluster": true,
65+
"node_type": "db-pro2-xxs",
66+
"disable_backup": false,
67+
"user_name": "my_initial_user",
68+
"password": "thiZ_is_v0ry_s3cret",
69+
"volume_type": "sbs_5k",
70+
"volume_size": "30000000000",
71+
"encryption": {
72+
"enabled": true
73+
}
74+
}'
75+
```
76+
You should get a response like the following confirming that the Database Instance was created, and encryption at rest is enabled.
77+
78+
```json
79+
{
80+
"id": "f5122f66-fb50-4cef-aa02-487ef4fc1af0",
81+
"name": "myDB",
82+
"organization_id": "895693aa-3915-4896-8761-c2923b008be7",
83+
"project_id": "d8e65f2b-cce9-40b7-80fc-6a2902db6826",
84+
"status": "ready",
85+
"engine": "PostgreSQL-15",
86+
"endpoint": {
87+
"ip": "198.51.100.0",
88+
"port": 22245,
89+
"name": null
90+
},
91+
"tags": [
92+
"donnerstag"
93+
],
94+
"settings": [],
95+
"backup_schedule": {
96+
"frequency": 24,
97+
"retention": 7,
98+
"disabled": true
99+
},
100+
"is_ha_cluster": true,
101+
"read_replicas": [],
102+
"node_type": "db-pro2-xxs",
103+
"volume": {
104+
"type": "sbs_5k",
105+
"size": 30000000000
106+
},
107+
"encryption": {
108+
"enabled": true
109+
},
110+
"created_at": "2019-04-19T16:24:52.591417Z",
111+
"region": "fr-par"
112+
}
113+
```
114+
115+
## Enabling encryption at rest in an existing Database Instance
116+
117+
To enable encryption at rest after a Database Instance has already been created, you can use the upgrade endpoint of the Managed Databases API.
118+
119+
Run the following command. Make sure you replace the `instance_id` in the endpoint, and the `enable_encryption` parameter set to `true`
120+
121+
```json
122+
curl -X POST \
123+
-H "X-Auth-Token: $SCW_SECRET_KEY" \
124+
-H "Content-Type: application/json" \
125+
-d '{
126+
"enable_encryption": true
127+
}' \
128+
"https://api.scaleway.com/rdb/v1/regions/fr-par/instances/{instance_id}/upgrade"
129+
```
130+
131+
If the operation is successful, you see an output containing all the details of your Database Instance, including `"encryption":{"enabled":true}`.
132+

‎managed-databases/postgresql-and-mysql/reference-content/encryption-at-rest-performance-benchmark.mdx‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
meta:
3+
title: Encryption at rest performance benchmark on Database Instances
4+
description: This page shows benchmarks of different Database Instances' performance when encryption at rest is enabled.
5+
content:
6+
h1: IEncryption at rest performance benchmark on Database Instances
7+
paragraph: This page shows benchmarks of different Database Instances' performance when encryption at rest is enabled.
8+
tags: managed-database postgresql mysql encryption at rest
9+
dates:
10+
validation: 2024-12-19
11+
posted: 2024-12-19
12+
categories:
13+
- managed-databases
14+
- postgresql-and-mysql
15+
---
16+
17+
The Scaleway Managed Databases team ran tests on DB-POP2-4C-16G Instances in a Private Network using `pgbench`. Several workloads (including read, oltp and large loads) were simulated with several scale factors (from 1M rows to 200M rows) and concurrent database connections set to 10. They measured the impact of encryption at rest on transactions, per second and latency.
18+
19+
<Message type="important">
20+
For more information on pgbench transactions, refer to the official [pgbench documentation](https://www.postgresql.org/docs/current/pgbench.html).
21+
</Message>
22+
23+
The table below compares the different workload and setup combinations and indicates the perfomance results of each:
24+
25+
| Workload Type | Setup | Scale Factor | Performance Impact |
26+
|----------------------|-----------------|--------------|------------------------------------------------------------------------------------|
27+
| **Read Workloads** | Standalone | 10 | No impact |
28+
| | Standalone | 2000 | No real impact with or without encryption at rest |
29+
| | HA | 2000 | 20-30% impact, likely due to disk writes being replicated |
30+
| **OLTP Workloads** | Standalone | Any | 15% performance drop with encryption at rest activated |
31+
| | HA | 10 | 15% performance drop |
32+
| | HA | 2000 | Up to 30% performance drop |
33+
| **Large Data Loads** | Standalone | Any | 10% additional latency |
34+
| | HA | Any | 40% additional latency due to semi-sync replication and encryption overhead |
35+

‎menu/navigation.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2198,6 +2198,10 @@
21982198
"label": "PostgreSQL extensions reference",
21992199
"slug": "postgresql-extensions"
22002200
},
2201+
{
2202+
"label": "Encryption at rest performance benchmark",
2203+
"slug": "encryption-at-rest-performance-benchmark"
2204+
},
22012205
{
22022206
"label": "Understanding the autohealing feature",
22032207
"slug": "autohealing"
@@ -2212,6 +2216,10 @@
22122216
"label": "Managed Database for PostgreSQL and MySQL API Reference",
22132217
"slug": "https://www.scaleway.com/en/developers/api/managed-database-postgre-mysql/"
22142218
},
2219+
{
2220+
"label": "Setting up encryption at rest",
2221+
"slug": "setting-up-encryption-at-rest"
2222+
},
22152223
{
22162224
"label": "Setting up and using the pgaudit extension",
22172225
"slug": "pg-audit"

0 commit comments

Comments
 (0)