Automatic TDE Encryption Key Rotation Using HashiCorp Vault as the Key Management System

MySQL & MariaDB Percona XtraDB Cluster 8.x
1

How can one do automatic key rotation in Percona for TDE using HashiCorp Vault as the Key Management System? We are intending to use a primary-secondary pair of Percona servers and a community edition HA cluster of HashiCorp Vault.

1 Like
2

As far as I can tell, there is no such feature. You’d have to schedule a cron-job to run rotate the master key in MySQL, which will tell Vault to store the updated key.

https://www.percona.com/doc/percona-server/LATEST/security/rotating-master-key.html#rotating-master-key

2 Likes
3

Thanks for your response,

I ended up using the event_scheduler built into the Percona MySQL server which seems to work:

mysql> SHOW PROCESSLIST;
mysql> SET GLOBAL event_scheduler = ON;
mysql> CREATE EVENT key_rotation ON SCHEDULE EVERY 3600 SECOND DO ALTER INSTANCE ROTATE INNODB MASTER KEY;
1 Like
4

Awesome solution! I’m not a fan of the event scheduler but that’s a great way to do it!

1 Like