Re: Would PostgreSQL 16 native transparent data encryption support database level encryption? - Mailing list pgsql-general

From Stephen Frost
Subject Re: Would PostgreSQL 16 native transparent data encryption support database level encryption?
Date
Msg-id ZGa49CRDJoIfWa/a@tamriel.snowman.net
Whole thread Raw
In response to Re: Would PostgreSQL 16 native transparent data encryption support database level encryption?  (Tony Xu <tony.xu@rubrik.com>)
List pgsql-general
Greetings,

Really, please don't top-post on these lists.

* Tony Xu (tony.xu@rubrik.com) wrote:
> Regarding the multiple clusters idea, how does that work? Assume we can
> store one customer's data in one cluster, is it possible to have separate
> KEK for different clusters?

In the proposed TDE work, yes, each cluster (which is an entier
PostgreSQL system) would be able to have its own KEK.

> Why not using multiple clusters then?

There's a bit of overhead from each cluster and each would have their
own shared buffers pool of memory and such.

> Better isolation of the customers, but still on one server.

Depending on the OS, multi-cluster management on a given system is
easier or harder.  In my view, at least, Debian systems make having
multiple clusters on a given server a lot easier as they have
pg_createcluster, pg_lsclusters, etc, commands and management tools.

Another alternative would be to use container technology and Kubernetes
or OpenShift and a PG Operator to manage all the clusters across
whatever systems you're running on top of.

Of course, there are trade-offs to consider between all of these
different approaches.

Thanks,

Stephen

Attachment

pgsql-general by date:

Previous
From: Tony Xu
Date:
Subject: Re: Would PostgreSQL 16 native transparent data encryption support database level encryption?
Next
From: Kyotaro Horiguchi
Date:
Subject: Re: PostgreSQL 13 - Logical Replication - ERROR: could not receive data from WAL stream: SSL SYSCALL error: EOF detected