...

• Background re-encryption may affect performance. Performance impact can be managed using the following configuration options:
  1. reencryptionThreadCnt - number of threads used for re-encryption.
     
  2. reencryptionBatchSize - number of pages that are scanned during re-encryption under checkpoint lock.
     
  3. reencryptionRateLimit - page scanning speed limit in megabytes per second.
     
• The WAL history can be not enough to store all entries between checkpoints (this should be carefully tuned by properly setting the size of the WAL history and tuning the re-encryption performance).
• The WAL history (for delta rebalancing) may be lost for all cache groups due to background re-encryption.

Process management

...

The following commands should be added to control.sh utility:

  Get encryption key identifiers of the cache group:
    control.(sh|bat) --encryption cache_key_ids cacheGroupName

  Change the encryption key of the cache group:
    control.(sh|bat) --encryption change_cache_key cacheGroupName

  Get cache group encryption status:
    control.(sh|bat) --encryption cache_key_ids cacheGroupName

  Start cache group re-encryption:
    control.(sh|bat) --encryption start_reencryption cacheGroupName

  Stop cache group re-encryption:
    control.(sh|bat) --encryption stop_reencryption cacheGroupName

  View/change re-encryption rate limit:
    control.(sh|bat) --encryption reencryption_rate [limit]

...

// TBD

Public API changes

IgniteEncryption

...