Greenplum TDE: Wrap and Unwrap Commands are Blank in gpctl tde status after gpinitsystem with TDE enabled

Products

• VMware Tanzu Data Suite

Issue/Introduction

Symptoms

When initializing a Transparent Data Encryption (TDE) enabled Greenplum cluster, The cluster initializes successfully, but the TDE wrap and unwrap commands are not applied. Running gpctl tde status displays blank values for these commands:

# gpctl tde status
TDE Status
Segments: 5
Status: all 5 reachable segments consistent
Wrap command:
Unwrap command:

Additionally, checking the gpinitsystem output reveals Bash parsing errors, such as:

# gpinitsystem  -c /opt/greenplum_7.8.3/gpinitsystem_config -h /opt/greenplum_7.8.3/seg_hosts -a
...
/opt/greenplum_7.8.3/gpinitsystem_config: line 21: enc: command not found
/opt/greenplum_7.8.3/gpinitsystem_config: line 22: enc: command not found
...

Environment

Environment

• Greenplum Database 7.x (e.g., 7.8.3)
• Transparent Data Encryption (TDE) enabled

Cause

Root Cause

The issue may cause by Missing Double Quotes in the Config File: In gpinitsystem_config, the TDE_KEY_UNWRAP_COMMAND and TDE_KEY_WRAP_COMMAND variables must be enclosed in double quotes ("). If quotes are omitted, Bash misinterprets the spaces in the command string. gpinitsystem will accept the TDE algorithm but completely ignore the unparsed wrap/unwrap commands.

For example:

Bad syntax:

TDE_KEY_UNWRAP_COMMAND=openssl enc -d -aes-128-ctr -pbkdf2 -pass file:/home/gpadmin/tde_master.key
TDE_KEY_WRAP_COMMAND=openssl enc -aes-128-ctr -salt -pbkdf2 -pass file:/home/gpadmin/tde_master.key

Correct syntax:

TDE_KEY_UNWRAP_COMMAND="openssl enc -d -aes-128-ctr -pbkdf2 -pass file:/home/gpadmin/tde_master.key"
TDE_KEY_WRAP_COMMAND="openssl enc -aes-128-ctr -salt -pbkdf2 -pass file:/home/gpadmin/tde_master.key"

Resolution

Resolution

To resolve this issue, apply the correct syntax in the configuration file:

Step 1: Use proper syntax in gpinitsystem_config Ensure that your TDE_KEY_WRAP_COMMAND and TDE_KEY_UNWRAP_COMMAND are enclosed in double quotes and use the standard OpenSSL pipeline without the base64 -d decoding step.

Example:

TDE_KEY_UNWRAP_COMMAND="openssl enc -d -aes-128-ctr -pbkdf2 -pass file:/home/gpadmin/tde_master.key"
TDE_KEY_WRAP_COMMAND="openssl enc -aes-128-ctr -salt -pbkdf2 -pass file:/home/gpadmin/tde_master.key" 

Step 2: Clean up the existing data folder and perform the gpinitsystem again