Native MariaDb encryption and clustering

Question

Is native (table/Column/tablespace) database encryption possible in a clustered environment. The success criteria would be:

• Encrypted Logs
• Encryption in transit for all data protocols
• Native DB encryption
• High availability for 2 sites with ~30 ms latency between each
• 1-2 local copies at each site for Backups/reporting etc
• Sub 30 minute site failover time
• Minimal application re-engineering
• Assume AWS or Vault KMS

I just need a yes or a no at this stage. Thanks

Answer 1

• Encrypted Logs: You can encrypt the InnoDB redo log and binary log. See the limitations on which types of logs are not encrypted.
• Encryption in transit for all data protocols: You can enable secure communications, see e.g. Securing Communications in Galera Cluster
• Native DB encryption: Yes, assuming you're using the InnoDB storage engine, you can encrypt all tablespaces, individual tables, or everything excluding individual tables.
• High availability for 2 sites with ~30 ms latency between each: You can have a Galera cluster on each site, and have asynchronous master-slave or master-master replication between them. The latency depends on the link between the sites.
• 1-2 local copies at each site for Backups/reporting etc: Galera cluster has a full copy of the databases in each node.
• Sub 30 minute site failover time: Failover can be automated with a database proxy such as MariaDB MaxScale or ProxySQL, or a more general proxy like haproxy.
• Minimal application re-engineering: MariDB Galera cluster works much like a single MariaDB server instance from the application's point of view, but note that every table must have a primary key (a single or compound key), and that only the InnoDB storage engine is supported. Also note that unless you're only ever writing to a single node at a time (e.g. read-write splitting which can be configured e.g. with MaxScale), your application needs to take into account that transactions can fail both on individual statements within the transaction and after the commit - see Galera’s big gotcha for MySQL users for details.
• Assume AWS or Vault KMS: I don't know.

You may want to look into a solution such as SeveralNines' ClusterControl which I believe can automate a lot of this.