Migrate data to and from a TDE-enabled cluster

Select a documentation version: 18.3.0

• Current (18.3.0)
• 18.3.0
• Current (18.3.0)
• 18.3.0
• 18.1.0

This guide describes how to migrate data between Transparent Data Encryption (TDE)-enabled and non-encrypted clusters using pg_dump and pg_restore.

Both migration directions—TDE to non-encrypted and the other way around—are supported and use standard PostgreSQL logical backup tools.

Logical migration using pg_dump decodes the encrypted data on-the-fly at the source and dumps it as unencrypted SQL statements. When restored, the destination cluster writes the data according to its own encryption settings (encrypting it if TDE is enabled, or writing as plain text if TDE is disabled).

Caution: The generated SQL file contains unencrypted data from your database. Ensure it is stored securely and delete it once the restore process is complete.

Before you begin

• Ensure that you have installed AlloyDB Omni. For more information, see Install AlloyDB Omni using containers.
• If you are migrating to a TDE-enabled database server, make sure that you have set up your key management provider. For more information, see Create a TDE-enabled cluster.

Migrate a TDE-enabled database to a TDE-disabled database

1. Dump the database from the TDE-enabled database server to a file on the host.

   Docker

   docker exec -i TDE_CONTAINER_NAME pg_dump -U postgres -d DATABASE_NAME > /tmp/decrypted_dump.sql
   

   Podman

   podman exec -i TDE_CONTAINER_NAME pg_dump -U postgres -d DATABASE_NAME > /tmp/decrypted_dump.sql
   

2. Start a TDE-disabled AlloyDB Omni server by following the instructions in Install AlloyDB Omni using Docker.

3. Restore the dump file to the non-encrypted database server.

   Docker

   docker exec -i NON_TDE_CONTAINER_NAME psql -U postgres -c "CREATE DATABASE DATABASE_NAME"
   docker exec -i NON_TDE_CONTAINER_NAME psql -U postgres -d DATABASE_NAME < /tmp/decrypted_dump.sql
   

   Podman

   podman exec -i NON_TDE_CONTAINER_NAME psql -U postgres -c "CREATE DATABASE DATABASE_NAME"
   podman exec -i NON_TDE_CONTAINER_NAME psql -U postgres -d DATABASE_NAME < /tmp/decrypted_dump.sql
   

Migrate a TDE-disabled database to a TDE-enabled database

1. Use pg_dump to dump the database from the non-encrypted database server.

   Docker

   docker exec -i NON_TDE_CONTAINER_NAME pg_dump -U postgres -d DATABASE_NAME > /tmp/src_plaintext_dump.sql
   

   Podman

   podman exec -i NON_TDE_CONTAINER_NAME pg_dump -U postgres -d DATABASE_NAME > /tmp/src_plaintext_dump.sql
   

2. Start a TDE-enabled AlloyDB Omni server following the instructions in Create a TDE-enabled cluster.

3. Restore to the TDE-enabled database server. The data is transparently encrypted as it is written.

   Docker

   docker exec -i TDE_CONTAINER_NAME psql -U postgres -c "CREATE DATABASE DATABASE_NAME"
   docker exec -i TDE_CONTAINER_NAME psql -U postgres -d DATABASE_NAME < /tmp/src_plaintext_dump.sql
   

   Podman

   podman exec -i TDE_CONTAINER_NAME psql -U postgres -c "CREATE DATABASE DATABASE_NAME"
   podman exec -i TDE_CONTAINER_NAME psql -U postgres -d DATABASE_NAME < /tmp/src_plaintext_dump.sql
   

What's next

• Run and connect to AlloyDB Omni