Zsolt Parragi — Percona Community

TDE performance in PostgreSQL

Mon, 20 Jul 2026 00:00:00 +0000

What’s the impact of TDE on performance? People usually quickly throw together a few graphs with basic measurements and treat that as a complete answer, but the question is a bit more complex than that. In this blog post, I’ll try to explain it in a bit more detail: why showcasing a single graph isn’t good for anything other than marketing.

pg_tde: our fork is temporary, our commitment to open TDE is not

Wed, 08 Jul 2026 00:00:00 +0000

Recently we noticed a LinkedIn post promoting open_pg_tde, a fork of our pg_tde, claiming to be more open. I looked at the repository, and have to disagree with their claim. In this blog post, I’ll explain why.

The short version: open_pg_tde needs the exact same modified PostgreSQL that pg_tde does – TDE isn’t possible without those upstream changes. The only difference is delivery: they ship those changes as a patch file users have to apply by hand, while we provide a ready-made branch.

OIDC error scenarios

Thu, 30 Apr 2026 00:00:00 +0000

Last time, in OIDC in PostgreSQL: With Keycloak, we created a working demo setup that was able to successfully authenticate a user using OIDC.

In this blog post, we follow the same example, but instead of the success story, we explore how OAuth keeps our PostgreSQL servers secure.

We won’t focus on complex attack vectors, like the examples in the second blog post in the OIDC series. Instead of social engineering, we’ll look at practical errors, misconfigurations and honest mistakes - understanding error messages and how to fix them.

OIDC in PostgreSQL: With Keycloak

Mon, 19 Jan 2026 00:00:00 +0000

We spent a long time, two blog posts to be specific, talking about OAuth/OIDC in theory. Now we’ll take a more practical look at the topic: how can we configure PostgreSQL with a popular open source identity provider, Keycloak, and our pg_oidc_validator plugin?

We’ll not only look at the PostgreSQL configuration part, but also discuss the environment requirements and setting up Keycloak.

Docker containers

If you are only interested in trying out a working demo installation, we have a ready-to-use Docker Compose configuration available in our GitHub repo. This setup includes a Keycloak instance, a PostgreSQL server, and a utility container that runs psql, all running in different containers, simulating different machines.

OIDC in PostgreSQL: How It Works and Staying Secure

Mon, 17 Nov 2025 09:00:00 +0000

In the previous blog post about the topic, OAuth, OIDC and validators, we discussed basic terminologies to understand the differences between the protocols and how they relate to PostgreSQL.

In this second part, we’ll go one step further and see how OIDC works exactly in other software and in PostgreSQL, and what OAuthBearer is about. We also focus on the possible attacks and dangers in this flow with some examples to showcase why it’s important to use a properly configured secure provider and to teach our users not to just skim through the authorization process.

OAuth, OIDC, validators, what is all this about?

Fri, 07 Nov 2025 10:00:00 +0000

Somebody might tell you, “let’s configure PostgreSQL 18 with OIDC, it should be simple, only takes a few minutes!” And that might be the case if you already have an OIDC provider set up and know all the details about the protocols, configurations, and possible issues. Or it might take much longer if you just open your favorite search engine and type “What is this OIDC stuff about?”

In this series of blog posts, I’ll try to help with this task. First, by clearing up all the terminology and details in this article. Later, I’ll provide vendor-specific setup instructions for some of the popular providers, using our fully open source pg_oidc_validator plugin.

Percona pg_tde: A Security Review Reveals Robust Encryption

Thu, 24 Jul 2025 00:00:00 +0000

At Percona, we are committed to providing robust and secure database solutions. We recently engaged Longterm Security for an in-depth review of our Transparent Data Encryption (TDE) feature for PostgreSQL, known as pg_tde. This comprehensive assessment included a cryptographic design evaluation, an application security review for coding errors, and extensive fuzz testing. We’re excited to share the key takeaways from this engagement, highlighting both pg_tde’s strengths and areas for continued improvement.

Creating a Standby Cluster With the Percona Operator for PostgreSQL

Wed, 27 Mar 2024 00:00:00 +0000

In this video, Nickolay Ihalainen, a Senior Scaling Specialist at Percona Global Services, explains how to set up replication with standby clusters for Kubernetes databases using Percona’s open-source tools, including the Percona Operator for PostgreSQL

A Standby Cluster is a backup version of your main database. It’s there to keep your data safe and make sure your database can keep running even if something goes wrong with the main one.