PMM-14441 Update pmm-dump API to support encryption

api/dump/v1beta1/dump.proto

@@ -22,6 +22,8 @@ message Dump {
   google.protobuf.Timestamp start_time = 4;
   google.protobuf.Timestamp end_time = 5;
   google.protobuf.Timestamp created_at = 7;
+  // This field is set to true if the dump was created with encryption enabled, and false otherwise.
+  bool encrypted = 8;
 }
 
 message StartDumpRequest {
@@ -30,6 +32,10 @@ message StartDumpRequest {
   google.protobuf.Timestamp end_time = 3;
   bool export_qan = 4;
   bool ignore_load = 5;
+  // If true, the dump will be encrypted. Note that enabling encryption may increase the time required to create the dump.
+  bool enable_encryption = 6;
+  // The password used for encryption. It must be at least 8 characters long. This field is required if enable_encryption is true.
+  string encryption_password = 7;
 }
 
 message StartDumpResponse {

api/dump/v1beta1/json/v1beta1.json

@@ -70,6 +70,11 @@
                         "type": "string",
                         "format": "date-time",
                         "x-order": 5
+                      },
+                      "encrypted": {
+                        "description": "This field is set to true if the dump was created with encryption enabled, and false otherwise.",
+                        "type": "boolean",
+                        "x-order": 6
                       }
                     }
                   },
@@ -314,6 +319,16 @@
                 "ignore_load": {
                   "type": "boolean",
                   "x-order": 4
+                },
+                "enable_encryption": {
+                  "description": "If true, the dump will be encrypted. Note that enabling encryption may increase the time required to create the dump.",
+                  "type": "boolean",
+                  "x-order": 5
+                },
+                "encryption_password": {
+                  "description": "The password used for encryption. It must be at least 8 characters long. This field is required if enable_encryption is true.",
+                  "type": "string",
+                  "x-order": 6
                 }
               }
             }

api/swagger/swagger-dev.json

@@ -4763,6 +4763,11 @@
                         "type": "string",
                         "format": "date-time",
                         "x-order": 5
+                      },
+                      "encrypted": {
+                        "description": "This field is set to true if the dump was created with encryption enabled, and false otherwise.",
+                        "type": "boolean",
+                        "x-order": 6
                       }
                     }
                   },
@@ -5007,6 +5012,16 @@
                 "ignore_load": {
                   "type": "boolean",
                   "x-order": 4
+                },
+                "enable_encryption": {
+                  "description": "If true, the dump will be encrypted. Note that enabling encryption may increase the time required to create the dump.",
+                  "type": "boolean",
+                  "x-order": 5
+                },
+                "encryption_password": {
+                  "description": "The password used for encryption. It must be at least 8 characters long. This field is required if enable_encryption is true.",
+                  "type": "string",
+                  "x-order": 6
                 }
               }
             }

build/packages/rpm/server/SPECS/pmm-dump.spec

@@ -2,14 +2,14 @@
 
 %global repo            pmm-dump
 %global provider        github.com/percona/%{repo}
-%global commit          4c38e9442fb2f6b0146cd5a581f18db4ebb034f7
+%global commit          8353b46afd09746c07a6d1c001dd1ef72e6c4761
 %global shortcommit     %(c=%{commit}; echo ${c:0:7})
 %define build_timestamp %(date -u +"%y%m%d%H%M")
 %define release         1
 %define rpm_release     %{release}.%{build_timestamp}.%{shortcommit}%{?dist}
 
 Name:		pmm-dump
-Version:	0.7.1-ga
+Version:	0.8.0-ga
 Release:	%{rpm_release}
 Summary:	Percona PMM Dump allows to export and import monitoring metrics and query analytics.
 
@@ -37,6 +37,9 @@ install -p -m 0755 pmm-dump %{buildroot}%{_sbindir}/pmm-dump
 
 
 %changelog
+* Wed Apr 22 2026 Maxim Kondratenko <[email protected]> - 3.7.1
+- PMM-14441 Upgrade pmm-dump to support encryption
+
 * Wed Sep 24 2025 Michael Okoko <[email protected]> - 3.4.1
 - PMM-14349 Update pmm-dump sources.
 

managed/models/database.go

@@ -1180,6 +1180,10 @@ var databaseSchema = [][]string{
 	117: {
 		`DROP TABLE IF EXISTS percona_sso_details`,
 	},
+	118: {
+		`ALTER TABLE dumps ADD COLUMN encrypted boolean NOT NULL DEFAULT false`,
+		`UPDATE dumps SET encrypted = false`,
+	},
 }
 
 // ^^^ Avoid default values in schema definition. ^^^

managed/models/dump.go

@@ -67,6 +67,7 @@ type Dump struct {
 	IgnoreLoad   bool           `reform:"ignore_load"`
 	CreatedAt    time.Time      `reform:"created_at"`
 	UpdatedAt    time.Time      `reform:"updated_at"`
+	Encrypted    bool           `reform:"encrypted"`
 }
 
 // BeforeInsert implements reform.BeforeInserter interface.

managed/models/dump_helpers.go

@@ -57,6 +57,7 @@ type CreateDumpParams struct {
 	EndTime      *time.Time
 	ExportQAN    bool
 	IgnoreLoad   bool
+	Encrypted    bool
 }
 
 // Validate checks the validity of CreateDumpParams.
@@ -87,6 +88,7 @@ func CreateDump(q *reform.Querier, params CreateDumpParams) (*Dump, error) {
 		EndTime:      params.EndTime,
 		ExportQAN:    params.ExportQAN,
 		IgnoreLoad:   params.IgnoreLoad,
+		Encrypted:    params.Encrypted,
 	}
 	if err := q.Insert(dump); err != nil {
 		return nil, errors.WithStack(err)

managed/models/dump_helpers_test.go

@@ -40,7 +40,7 @@ func TestDumps(t *testing.T) {
 	})
 
 	t.Run("create", func(t *testing.T) {
-		t.Run("normal", func(t *testing.T) {
+		t.Run("normal non-encrypted", func(t *testing.T) {
 			endTime := time.Now()
 			startTime := endTime.Add(-10 * time.Minute)
 
@@ -62,6 +62,30 @@ func TestDumps(t *testing.T) {
 			assert.Equal(t, createDumpParams.IgnoreLoad, dump.IgnoreLoad)
 		})
 
+		t.Run("normal encrypted", func(t *testing.T) {
+			endTime := time.Now()
+			startTime := endTime.Add(-10 * time.Minute)
+
+			createDumpParams := models.CreateDumpParams{
+				ServiceNames: []string{"foo", "bar"},
+				StartTime:    &startTime,
+				EndTime:      &endTime,
+				ExportQAN:    false,
+				IgnoreLoad:   true,
+				Encrypted:    true,
+			}
+			dump, err := models.CreateDump(tx.Querier, createDumpParams)
+			require.NoError(t, err)
+			assert.NotEmpty(t, dump.ID)
+			assert.Equal(t, models.DumpStatusInProgress, dump.Status)
+			assert.ElementsMatch(t, createDumpParams.ServiceNames, dump.ServiceNames)
+			assert.Equal(t, createDumpParams.StartTime, dump.StartTime)
+			assert.Equal(t, createDumpParams.EndTime, dump.EndTime)
+			assert.Equal(t, createDumpParams.ExportQAN, dump.ExportQAN)
+			assert.Equal(t, createDumpParams.IgnoreLoad, dump.IgnoreLoad)
+			assert.Equal(t, createDumpParams.Encrypted, dump.Encrypted)
+		})
+
 		t.Run("invalid start and end time", func(t *testing.T) {
 			endTime := time.Now()
 			startTime := endTime.Add(10 * time.Minute)