Skip to content

Commit 1392bd7

Browse files
authored
Reworded the DELETE (previous DROP) key function in Architecture chapter
Readded the DELETE key function based on 1257 in Architecture chapter where we also update from DROP to DELETE.
1 parent 179f5d7 commit 1392bd7

File tree

1 file changed

+14
-6
lines changed
  • contrib/pg_tde/documentation/docs/architecture

1 file changed

+14
-6
lines changed

contrib/pg_tde/documentation/docs/architecture/index.md

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -293,15 +293,23 @@ With `pg_tde.inherit_global_key_providers`, it is also possible to set up a defa
293293

294294
With this feature, it is possible for the entire database server to easily use the same principal key for all databases, completely disabling multi-tenency.
295295

296-
A default key can be managed with the following functions:
296+
#### Manage a default key
297297

298-
```sql
299-
pg_tde_set_default_key_using_global_key_provider('key-name', 'provider-name', 'true/false')
300-
```
298+
You can manage a default key with the following functions:
299+
300+
* `pg_tde_set_default_key_using_global_key_provider('key-name','provider-name','true/false')`
301+
* `pg_tde_delete_principal_key()`
302+
303+
!!! note
304+
`pg_tde_delete_principal_key()` is only possible if there's no table currently using the default principal key.
305+
Changing the default principal key will rotate the encryption of internal keys for all databases using the current default principal key.
306+
307+
#### Deleting the key
301308

302-
`DROP` is only possible if there's no table currently using the default principal key.
309+
The `pg_tde_delete_principal_key()` function removes the principal key for the current database. If the current database has any encrypted tables, and there isn’t a default principal key configured, it reports an error instead. If there are encrypted tables, but there’s also a global default principal key, internal keys will be encrypted with the default key.
303310

304-
Changing the default principal key will rotate the encryption of internal keys for all databases using the current default principal key.
311+
!!! note
312+
WAL keys **cannot** be deleted, as server keys are managed separately.
305313

306314
### Current key details
307315

0 commit comments

Comments
 (0)