Alert description
This alert checks whether the tenant's TDE key information exists in the current OCP. Specifically, it verifies whether the external_kms_info parameter for the corresponding tenant in the GV$OB_PARAMETERS view can be matched with a corresponding KMS TDE key record in the kms_cmk_info table of the current OCP MetaDB.
Alert principle
Parameter |
Value |
|---|---|
| Monitoring Metrics | ob_tenant_kms_cmk_info_exist_status. This metric indicates whether the tenant's TDE key information exists in the current OCP. The parameter value is0indicates existence; the parameter value is1indicates non-existence and triggers an alert. |
| Monitoring Expression | max(ob_tenant_kms_cmk_info_exist_status{@LABELS}) by (@GBLABELS) |
| Metric Collection | ob_tenant_kms_cmk_info_exist_status |
| Data Source | Regularly queried by OCP-ServerGV$OB_PARAMETERSTenant in Viewexternal_kms_infoParameter, search by parameterkms_cmk_infoChecks whether the table contains corresponding key information records. If not, an alert is triggered. |
| Collection Cycle | 5 Seconds |
Rule information
Monitoring Expression |
Default Threshold |
Duration |
Detection Cycle |
Elimination Cycle |
|---|---|---|---|---|
| ob_tenant_kms_cmk_info_exist_status | 1 | 120 Seconds | 60 Seconds | 5 Minutes |
Alert information
Alert Trigger Method |
Alert Level |
Scope |
|---|---|---|
| Based on monitoring metric expressions | Critical | Tenant |
Alert template
Alert overview
- Template: ${alarm_target} ${alarm_name}
- Example: alarm_template_id=0:ob_cluster=xxx:tenant_name=xxx The tenant TDE key information does not exist in the current OCP. Please update the tenant TDE key promptly.
Alert Details
- Template: The TDE key information for tenant ${tenant_name} in OceanBase cluster ${ob_cluster_name} does not exist in the current OCP. Please update the tenant's TDE key promptly.
- Example: The TDE key information for tenant xxx in the OceanBase cluster Test does not exist in the current OCP. Please update the tenant's TDE key promptly.
Alert Recovery
- Template: Alert: ${alarm_name}, Does the tenant's TDE KMS information exist in the current OCP: ${value}
- Example: Alert: The tenant TDE key information does not exist in the current OCP. Please update the tenant TDE key promptly. Does the tenant TDE KMS information exist in the current OCP? 0
Impact on the system
Features such as adding OBServer nodes, creating standby tenants, and creating encrypted tablespaces will be unavailable.
Possible causes
- The
cmkIdorkmsEndpointdata of the secret in theprofile_credentialtable of the current OCP MetaDB has been modified via the command line. - Modified the
access_key_idvalue of theexternal_kms_infoparameter for the corresponding tenant in theGV$OB_PARAMETERSview via the command line. - Failure to promptly complete TDE configuration for the relevant tenant after migrating out and taking over the cluster.
Solution
- Method 1: Go to the cluster overview module corresponding to the alert, and click Modify Encryption as prompted on the page. This will take you to Security Configuration > Transparent Data Encryption where you can modify the TDE encryption information for the corresponding tenant.
- Method 2: In the cluster where the tenant belongs, go to Security Configuration > Transparent Data Encryption to modify the TDE information for the corresponding tenant.