Provision TDE-enabled virtual PDBs to new virtual CDBs

This topic describes how to provision a TDE-enabled virtual pluggable database (vPDB) to a virtual container database (vCDB) using the command-line interface.

This process applies to Oracle version 12.2.0.1 or later versions.

Prerequisites

The prerequisites are the same as described in CLI Cookbook: Provisioning a Virtual PDB to a new virtual CDB, additionally the following are the extra prerequisites:

TDE must be configured for the source container database before it’s linked to the engine.

The source PDB must have TDE configured before it’s linked as dSources to Delphix.
The keystore file of the source container database must be accessible from the target host. If the target database is running in a RAC environment, the keystore file of the source container database must be accessible from all target nodes.
If the target database is running in a RAC environment, TDE Keystores Root must be set for each node.

In the example CLI provision detailed below, assuming:

The source container database TDE Keystore Password is mySrcCdbTdePwd.
The source container database keystore file can be accessed from the target host(s) with path /u01/app/oracle/keystores/cdb12/wallet.
The new vCDB’s keystore file will be created under the folder /u01/app/oracle/keystores/cdbvirt/wallet.
The new vCDB’s TDE Keystore Password is myVcdbTdePwd.
The OKV client names are myOkvClient, myOkvClient-1, and myOkvClient-2.
The vPDB’s TDE Secret for Exported Keys is myVpdbTdeSecre.
The source PDB’s isolated mode TDE Keystore Password is mySrcPdbTdePwd.
The source PDB’s isolated mode keystore file can be accessed from the target host(s) with path /u01/app/oracle/keystores/cdb12/pdb1/wallet.
The new vPDB’s TDE keystore password is myVpdbTdePwd

For more information about TDE parameters, please refer to Provisioning a TDE-enabled vPDB.

Procedure

After following all steps in the Procedure section of CLI Cookbook: Provisioning a Virtual PDB to a new virtual CDB to set provision parameters, set TDE-related parameters as follows before commit:

Software keystore

Set parentTdeKeystorePath, which is the path used to access the source CDB’s TDE keystore file from target host(s).
```
delphix database provision *> set source.parentTdeKeystorePath=/u01/app/oracle/keystores/cdb12/wallet
```
Set parentTdeKeystorePassword, which is the password of the source CDB’s TDE keystore.
```
delphix database provision *> set source.parentTdeKeystorePassword=mySrcCdbTdePwd
```
Supply tdeExportedKeyFileSecret, which is the password used for exporting the vPDB’s keys to keyfile.
```
delphix database provision *> set source.tdeExportedKeyFileSecret=myVpdbTdeSecret
```

Set targetVcdbTdeKeystorePath, which is the folder where the new vCDB’s TDE keystore file will be created.

delphix database provision *> set source.targetVcdbTdeKeystorePath=/u01/app/oracle/keystores/cdbvirt/wallet

Set targetVcdbTdeKeystorePassword, which is the password of the new vCDB's TDE keystore.
```
delphix database provision *> set source.targetVcdbTdeKeystorePassword=myVcdbTdePwd
```
If the source PDB is in isolated mode, then set the following additional parameters to provision the vPDB in isolated mode.
1. Set parentPdbTdeKeystorePath, which is the path used to access the source PDB’s isolated mode TDE keystore file from target host(s).
```
delphix database provision *> set source.parentPdbTdeKeystorePath=/u01/app/oracle/keystores/cdb12/pdb1/wallet
```
2. Set parentPdbTdeKeystorePassword, which is the password of the source PDB’s isolated mode TDE keystore.
```
delphix database provision *> set source.parentPdbTdeKeystorePassword=mySrcPdbTdePwd
```
3. Set targetPdbTdeKeystorePassword, which is the password of the new vPDB’s isolated mode TDE keystore.
```
delphix database provision *> set source.targetPdbTdeKeystorePassword=myVpdbTdePwd
```
After all parameters are set, initiate the provision by committing the operation in the CLI:
```
delphix database provision *> commit
```

OKV keystore

Supply tdeExportedKeyFileSecret, which is the password used for exporting the vPDB’s keys to keyfile.
```
delphix database provision *> set source.tdeExportedKeyFileSecret=myVpdbTdeSecret
```
Set tdeKeystoreConfigType, which is the keystore config type of the new virtual CDB.
```
delphix database provision *> set virtualCdb.sourceConfig.tdeKeystoreConfigType=OKV
```
Set okvClient, which is the name of the OKV client used by the new virtual CDB instance. If the new virtual CDB is a RAC CDB, okvClient must be set for each instance.
- For single instance new virtual CDB:
```
delphix database provision *> set virtualCdb.sourceConfig.instance.okvClient=myOkvClient
```
- For RAC new virtual CDB:
```
delphix database provision *> set virtualCdb.sourceConfig.instances.0.okvClient=myOkvClient-1
delphix database provision *> set virtualCdb.sourceConfig.instances.1.okvClient=myOKvClient-2
```
  The okvClient is optional if there is only one OKV client on the host where the database instance runs, as Delphix can auto-select the OKV client during provisioning in such cases. For more information, refer to the Auto-selecting OKV clients page.
After all parameters are set, initiate the provision by committing the operation in the CLI:
```
delphix database provision *> commit
```

Last updated

Oct 9, 2026