The Delphix Engine supports provisioning from a dSource linked to a physical database that has been encrypted with Oracle's Transparent Database Encryption (TDE), which can be used to encrypt columns or tablespaces.
Provisioning a VDB from an encrypted dSource requires an autologin wallet setup in the target environment, because the provisioning process requires the master key to be stored in the wallet file. This can be achieved by either copying the ewallet.p12 and cwallet.sso files to the target host (to do this, the wallet must not be created with the “local” option), or by creating a new autologin wallet on the target, then exporting / importing the keys to this wallet.
For more information, read the Provisioning TDE-enabled VDB page.
Provision a TDE-enabled vPDB to an existing or linked CDB
To provision a TDE-enabled VDB to existing CDB in DCT, follow these steps:
-
Log in to the DCT instance.
-
Navigate to Data > VDB and click Provision VDB. For more information, read the Provisioning a VDB page.
-
Select the Oracle dSource under the dSources tab to provision and click Next.
-
On the Provision Point page, choose any of the following options:
-
Select Provision Point: Select the provision point displayed on this page.
-
Select Exact Time (Slower): Choose the exact date and time using the calendar.
-
SCN Number Refresh (Slower): Enter the Oracle system change (SCN) number range.
-
Bookmarks: Choose the bookmark from the list.
-
Click Next.
-
-
Select target environment and repository and click Next.
-
On the Target Configuration page, select the File option under the TDE Keystore Config Type and enter the following details:
-
TDE keystore mode: select the following options:
-
United: Configure one keystore for the CDB root and any associated united mode PDBs. For more information, read Oracle documentation for united mode. For basic requirements for TDE software keystore in united mode, read the TDE-enabled vPDB requirements page.
-
Isolated: Create and manage both keystores and TDE master encryption keys in an individual pluggable database (PDB). For more information, read Oracle documentation for isolated mode. For additional requirements for TDE software keystore in isolated mode, read the TDE-enabled vPDB requirements page.
Creating a Container Database (CDB) is not supported in the Isolated mode.
-
-
Parent Database TDE Keystore Location: Enter the Parent KeyStore path with the keys used to encrypt the dSource PDB files.
-
Parent Database TDE Keystore Password: Enter the password for the Parent database TDE keystore.
-
TDE Secret for Exported Keys: Enter the KeyStore for the target CDB into which the TDE-encrypted vPDB is plugged.
-
Parent PDB TDE Keystore Path: Enter the parent PDB TDE keystore path for the Isolated mode only.
-
Parent PDB TDE Keystore Password: Enter the password for the parent PDB keystore for the Isolated mode only.
-
Target PDB TDE Keystore Password: Enter the password for the parent PDB keystore for the Isolated mode only.
For TDE keystore term definitions, read the Delphix glossary page.
-
-
Click Next.
-
On the Policies page, select the default DCT Snapshot and DCT Retention policies and click Next.
-
(Optional) On the Masking page, select the Mask this VDB check box and click Next.
-
(Optional) On the Hooks page, configure provisioning hooks and click Next. For more information, read the Hook operations list and Oracle Hook operations page.
Review the VDB summary details and click Submit.
Provision a TDE-enabled vPDB to a new CDB
To provision a TDE-enabled VDB to new CDB in DCT, follow these steps:
-
Log in to the DCT instance.
-
Navigate to Data > VDB and click Provision VDB.
-
Select the Oracle dSource under the dSources tab to provision and click Next.
-
On the Provision Point page, choose any of the provision point option and click Next.
-
On the Target Environment page, select the Create a new container database check box and click Next.
-
Follow the instructions from step # 6 to 11 in the previous section to complete the provisioning of a new CDB task.