TDE pg_upgrade use cases

EDB supports using pg_upgrade with additional TDE upgrade arguments to add encryption to unencrypted systems. This table provides an overview of supported use cases.

Use case	Source unencrypted server	Target encrypted server
Perform a minor upgrade and add encryption	Unencrypted EDB Postgres Extended Server 16.1	Encrypted EDB Postgres Extended Server 16.2
Change the Postgres distribution and add encryption	Unencrypted PostgreSQL 16	Encrypted EDB Postgres Advanced Server 16
Maintain the Postgres distribution and add encryption	Unencrypted EDB Postgres Advanced Server 15	Encrypted EDB Postgres Advanced Server 15
Maintain the Postgres distribution and rotate encryption keys	Encrypted EDB Postgres Advanced Server 15	Encrypted EDB Postgres Advanced Server 15 with new encryption keys

Important

Both source and target servers must be in the same Postgres major version. pg_upgrade only supports upgrades between minor versions.

Overview

To enable encryption:

1. Perform a backup of your system.

2. Install the target Postgres version.

3. Initialize a new server with TDE enabled.

4. Use pg_upgrade with the --copy-by-block option to upgrade to a TDE system.

Tutorials

• Enabling TDE on an existing EDB Postgres Advanced Server cluster .

• Upgrading PostgreSQL to EDB Postgres Extended Server while enabling TDE .

• Upgrading PostgreSQL to EDB Postgres Extended Server while enabling TDE
  • Worked example
    • Preparing your upgrade
    • Creating an encrypted server
    • Upgrading to the encrypted server
    • Cleaning up after upgrade