Migrating a TDE software keystore based vPDB or PDB to OKV-enabled vPDB or PDB

This topic describes the process for migrating a TDE-enabled virtual pluggable database (vPDB) or PDB that uses a TDE software keystore to one that uses Oracle Key Vault (OKV). The procedure involves several manual steps, both outside of Delphix and within the Delphix CLI. This process applies to multitenant databases, including CDBs and vCDBs.

Procedure

To migrate a TDE software keystore based vPDB/PDB to OKV enabled vPDB/PDB, follow these steps:

Enroll the CDB/vCDB database as an endpoint of the OKV server

1. Install the OKV client software under the existing wallet_root directory. For example, if the current wallet_root is /work/mycdb, the OKV client software should be installed in /work/mycdb/okv.

2. Configure a default wallet for the endpoint on the OKV server (for example, MY-CDB-WALLET).

3. For more information, refer to the Oracle Key Vault documentation on Enrolling and Upgrading Endpoints for Oracle Key Vault.

Migrate software keystore to OKV keystore outside Delphix

1. Follow the OKV documentation Migrating an Existing TDE Wallet to Oracle Key Vault to migrate the existing software keystore to OKV keystore.

2. Upload the software wallet (ewallet.p12) of the CDB/vCDB to the corresponding OKV endpoint wallet. Example:

   /work/mycdb/okv/bin/okvutil upload -t wallet -l /work/mycdb/tde -g MY-CDB-WALLET -v 4 

3. Set parameter TDE_CONFIGURATION. Example:

   ALTER SYSTEM SET TDE_CONFIGURATION = "KEYSTORE_CONFIGURATION=OKV|FILE" SCOPE = BOTH; 

4. Reconnect to the CDB/vCDB, then migrate the encryption keys to OKV. Example:

   ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY IDENTIFIED BY "YourOkvEndpointPassword" MIGRATE USING "YourSoftwareWalletPassword" WITH BACKUP; 

5. Remove or rename the software wallet file ewallet.p12 under $wallet_root/tde. Example:

   mv /work/mycdb/tde/ewallet.p12    /work/mycdb/tde/ewallet.p12.bak 

6. Reconnect to the CDB/vCDB, add OKV password to the autologin wallet under $wallet_root/tde. Example:

   administer key management add secret 'YourOkvEndpointPassword' for client 'OKV_PASSWORD' to auto_login keystore '/work/mycdb/tde' with backup; 

Update CDB/vCDB properties using the CLI

All steps in this section must be performed from the Delphix CLI using the admin user or another user with equivalent administrative privileges.

1. Update the CDB/vCDB property tdeKeystoreConfigType from FILE to OKV. Example:

   YourEngine sourceconfig> select MYCDB 
   YourEngine sourceconfig 'MYCDB'> update 
   YourEngine sourceconfig 'MYCDB' update *> set tdeKeystoreConfigType=OKV 
   YourEngine sourceconfig 'MYCDB' update *> commit 

2. Follow Delphix documentation Manage OKV clients to create a new OKV client for the CDB/vCDB. Example:

   YourEngine host oracle okvclient> create  
   YourEngine host oracle okvclient create *> set name=mycdb-okv  
   YourEngine host oracle okvclient create *> set host=myhost  
   YourEngine host oracle okvclient create *> set path=/work/mycdb/okv  
   YourEngine host oracle okvclient create *> set password=YourOkvEndpointPassword 
   YourEngine host oracle okvclient create *> commit 

3. Set the CDB/vCDB’s okvClient property to the OKV client just created. Example:

   YourEngine sourceconfig 'MYCDB'> update 
   YourEngine sourceconfig 'MYCDB' update *> set instance.okvClient=mycdb-okv 
   YourEngine sourceconfig 'MYCDB' update *> commit 

4. Unset parentTdeKeystorePath for the vPDBs in the CDB/vCDB.

   If there is vPDB in the CDB/vCDB, unset its property parentTdeKeystorePath. Example:

   YourEngine source 'MYVPDB'> update 
   YourEngine source 'MYVPDB' update *> unset parentTdeKeystorePath 
   YourEngine source 'MYVPDB' update *> commit 

5. Update tdeKeyIdentifier.

   First, connect to the CDB/vCDB using SQL*Plus and run the following query to retrieve the currently activated key_id for the CDB/vCDB and all associated vPDBs. Example:

   SQL> select con_id, key_id from v$encryption_keys  order by con_id; 
   
       CON_ID KEY_ID 
   
   ---------- ------------------------------------------------------------------------------ 
    1 06E986A6BCFF2E4FDEBFFA79E5B66D51D2 
    3 06629CE52EA3674F1BBF2151EAD0E044B2 

   Next, update the tdeKeyIdentifier property for each vPDB in the CDB/vCDB individually. If the container database is a vCDB, update the tdeKeyIdentifier for the vCDB itself as well. Use the key_id values retrieved from the query above. Example:

   YourEngine source 'MYVPDB'> update 
   YourEngine source 'MYVPDB' update *> set tdeKeyIdentifier=06629CE52EA3674F1BBF2151EAD0E044B2 
   YourEngine source 'MYVPDB' update *> commit  
   YourEngine source 'MYCDB'> update 
   YourEngine source 'MYCDB' update *> set tdeKeyIdentifier=06E986A6BCFF2E4FDEBFFA79E5B66D51D2 
   YourEngine source 'MYCDB' update *> commit 

6. At this point, the CDB/vCDB and all associated PDBs/vPDBs have been successfully migrated from a software keystore to an OKV keystore.

Supported and unsupported Delphix operations after migration

After a CDB/vCDB and its associated PDBs/vPDBs have been migrated from a software keystore to an OKV keystore, the following Delphix operations are supported and unsupported:

Supported operations

1. The following operations are supported after the migration:

   Lifecycle operations for virtual objects (vPDB/vCDB only):

   • Stop

   • Start

   • Disable

   • Enable

   • Delete

     For linked PDBs/CDBs, lifecycle operations must be performed outside of Delphix using SQL*Plus.

2. Provision a new vPDB from the latest point‑in‑time of the dSource PDB.

3. Refresh a migrated vPDB to the latest point‑in‑time of its parent dSource.

4. Create a new incremental or full snapshot of the migrated PDB/vPDB, and provision a vPDB from any new snapshot created after the migration.

Unsupported operations

The following operations are not supported after the migration:

• Provisioning a new vPDB using a snapshot of the dSource PDB taken before the migration.

• Refreshing a migrated vPDB to a snapshot of its parent dSource that was created before the migration.

• Rewinding a migrated vPDB to a snapshot that was taken before the migration.