Page History

...

1. Start distributed process CACHE_GROUP_KEY_CHANGE_PREPARE, each node
   1. verifies that re-encryption is not in progress for the specified cache group.
      
   2. ensures that new key identifier does not exist
2. After successful completion of PREPARE, start distributed process CACHE_GROUP_KEY_CHANGE_FINISH, each node
   1. saves logical WAL record (ENCRYPTION_STATUS_RECORD) with current groups and key identifiers to start re-encryption after logical recovery.
   2. save the new key in the metastore (as inactive key)
   3. sets it for writing
   4. adds the mapping "WAL segment -> *old* key identifier" (to safely cleanup previous key in the future)
   5. save current keys and WALl mappings into the metastore.
   6. starts background re-encryption of an existing data.

...