cli: support encrypted fs with pebble debug tool

Release note (cli change): The `cockroach debug pebble` tool
can now be used with encrypted stores.

pkg/ccl/cliccl/debug.go

@@ -92,7 +92,7 @@ AES128_CTR:be235...   # AES-128 encryption with store key ID
 	// Add encryption flag to all OSS debug commands that want it.
 	for _, cmd := range cli.DebugCmdsForRocksDB {
 		// storeEncryptionSpecs is in start.go.
-		cli.VarFlag(cmd.Flags(), &storeEncryptionSpecs, cliflagsccl.EnterpriseEncryption)
+		cli.VarFlag(cmd.PersistentFlags(), &storeEncryptionSpecs, cliflagsccl.EnterpriseEncryption)
 	}
 
 	cli.PopulateRocksDBConfigHook = fillEncryptionOptionsForStore

pkg/cli/BUILD.bazel

@@ -194,6 +194,7 @@ go_library(
         "@com_github_cockroachdb_logtags//:logtags",
         "@com_github_cockroachdb_pebble//:pebble",
         "@com_github_cockroachdb_pebble//tool",
+        "@com_github_cockroachdb_pebble//vfs",
         "@com_github_cockroachdb_redact//:redact",
         "@com_github_dustin_go_humanize//:go-humanize",
         "@com_github_elastic_gosigar//:gosigar",

pkg/cli/debug.go

@@ -61,6 +61,7 @@ import (
 	"github.com/cockroachdb/errors"
 	"github.com/cockroachdb/pebble"
 	"github.com/cockroachdb/pebble/tool"
+	"github.com/cockroachdb/pebble/vfs"
 	"github.com/gogo/protobuf/jsonpb"
 	"github.com/kr/pretty"
 	"github.com/spf13/cobra"
@@ -695,6 +696,35 @@ var debugPebbleCmd = &cobra.Command{
 	Long: `
 Allows the use of pebble tools, such as to introspect manifests, SSTables, etc.
 `,
+	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+		storageConfig := base.StorageConfig{
+			Settings: serverCfg.Settings,
+			Dir:      serverCfg.Stores.Specs[0].Path,
+		}
+
+		if PopulateRocksDBConfigHook != nil {
+			if err := PopulateRocksDBConfigHook(&storageConfig); err != nil {
+				return err
+			}
+			if storageConfig.EncryptionOptions == nil {
+				pebbleToolFS.set(vfs.Default)
+				return nil
+			}
+		}
+
+		cfg := storage.PebbleConfig{
+			StorageConfig: storageConfig,
+			Opts:          storage.DefaultPebbleOptions(),
+		}
+
+		_, _, err := storage.ResolveEncryptedEnvOptions(&cfg)
+		if err != nil {
+			return err
+		}
+
+		pebbleToolFS.set(cfg.Opts.FS)
+		return nil
+	},
 }
 
 var debugEnvCmd = &cobra.Command{
@@ -1233,6 +1263,7 @@ var DebugCmdsForRocksDB = []*cobra.Command{
 	debugRaftLogCmd,
 	debugRangeDataCmd,
 	debugRangeDescriptorsCmd,
+	debugPebbleCmd,
 }
 
 // All other debug commands go here.
@@ -1291,6 +1322,22 @@ func (m lockValueFormatter) Format(f fmt.State, c rune) {
 	fmt.Fprint(f, kvserver.SprintIntent(m.value))
 }
 
+// swappableFS is a vfs.FS that can be swapped out at a future time.
+type swappableFS struct {
+	vfs.FS
+}
+
+// set replaces the FS in a swappableFS.
+func (s swappableFS) set(fs vfs.FS) {
+	s.FS = fs
+}
+
+// pebbleToolFS is the vfs.FS that the pebble tool should use.
+// It is necessary because an FS must be passed to tool.New before
+// the command line flags are parsed (i.e. before we can determine
+// if we have an encrypted FS).
+var pebbleToolFS = &swappableFS{vfs.Default}
+
 func init() {
 	DebugCmd.AddCommand(debugCmds...)
 
@@ -1315,7 +1362,9 @@ func init() {
 	// and merger functions must be specified to pebble that match the ones used
 	// to write those files.
 	pebbleTool := tool.New(tool.Mergers(storage.MVCCMerger),
-		tool.DefaultComparer(storage.EngineComparer))
+		tool.DefaultComparer(storage.EngineComparer),
+		tool.FS(pebbleToolFS),
+	)
 	debugPebbleCmd.AddCommand(pebbleTool.Commands...)
 	DebugCmd.AddCommand(debugPebbleCmd)
 

pkg/cli/flags.go

@@ -857,6 +857,10 @@ func init() {
 		f := debugBallastCmd.Flags()
 		varFlag(f, &debugCtx.ballastSize, cliflags.Size)
 	}
+	{
+		f := debugPebbleCmd.PersistentFlags()
+		varFlag(f, &serverCfg.Stores, cliflags.Store)
+	}
 	{
 		for _, c := range []*cobra.Command{
 			doctorExamineClusterCmd,