Purpose
Before data backup, if the original tenant has transparent encryption configured, use the ALTER SYSTEM BACKUP KEY statement to back up the key for the source tenant.
Limitations and considerations
After backing up the key, if the source tenant triggers a key rotation before data recovery, you need to back up the source tenant's key again.
Privilege requirements
The sys tenant's root user (root@sys) or the administrator user of each tenant must execute this statement. Specifically:
- The default administrator user in MySQL mode is
root. - The default administrator user in Oracle mode is
SYS.
Syntax
ALTER SYSTEM BACKUP KEY [TENANT [=] {tenant_name[, tenant_name]...}] TO 'backup_key_path' [ENCRYPTED BY 'password'];
Parameters
| Parameter | Description |
|---|---|
| tenant_name | Specifies the tenant name for which to back up the key. You can specify multiple tenant names at a time. Different tenant names are separated by commas (,). If no tenant name is specified, the keys of all user tenants in the cluster are backed up.
NoticeOnly the system tenant can specify the |
| backup_key_path | Specifies the path to back up the key. This path is user-defined and must be different from the data backup or log archiving path. |
| password | Specifies the encryption password for the key backup path. If not specified, the backup path is not encrypted by default. |
Examples
The system tenant will
The system tenant backs up the key of the
mysql_tenanttenant to thefile:///data_backup_dest/keypath and sets an encryption password.obclient [oceanbase]> ALTER SYSTEM BACKUP KEY TENANT = mysql_tenant TO 'file:///data_backup_dest/key' ENCRYPTED BY '******';The
mysql_tenanttenant backs up its own key to thefile:///data_backup_dest/keypath.obclient [oceanbase]> ALTER SYSTEM BACKUP KEY TO 'file:///data_backup_dest/key';