# Configuring the Component Keyring in Percona Server and PXC … | Percona Community

**URL:** <https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047>\
**Category:** Community website\
**Created:** [January 14, 2026, 3:20pm UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047 "2026-01-14T15:20:40Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\
**Post date:** [January 14, 2026, 3:20pm UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/1 "2026-01-14T15:20:40Z")

</div>

_(Or: how to make MySQL encryption boring, which is the goal)_

Encryption is one of those things everyone agrees is important, right up until MySQL refuses to start and you’re staring at a JSON file wondering which brace ruined your evening.

* * *
This is a companion discussion topic for the original entry at [https://percona.community/blog/2026/01/13/configuring-the-component-keyring-in-percona-server-and-pxc-8.4](https://percona.community/blog/2026/01/13/configuring-the-component-keyring-in-percona-server-and-pxc-8.4)

---

<div class="post-metadata">

**Author:** ![pkm2112](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/pkm2112/32/21433_2.png) [@pkm2112](https://forums.percona.com/u/pkm2112)\
**Post date:** [March 25, 2026, 4:04am UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/2 "2026-03-25T04:04:18Z")

</div>

Hi @daniil.bazhenov

Thanx for the post. I’ve configured keyring using “component\_keyring\_file” . Works as expected with global manifest configuration. However when I switch to local manfest configuration (“read\_local\_manifest”: true)” master key isnt accessible.

I was able to successfully do both global and local manifest configuration with oracle mysql 8.4.6

Does percona support local manifest configuration though I dont see any restrictions in technical doc

Cheers

Mohan

---

<div class="post-metadata">

**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\
**Post date:** [March 25, 2026, 5:29am UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/3 "2026-03-25T05:29:21Z")

</div>

Thank you for your question. I suggest calling @Wayne_Leutwyler for help.

---

<div class="post-metadata">

**Author:** ![hieu.nguyen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/hieu.nguyen/32/21872_2.png) [@hieu.nguyen](https://forums.percona.com/u/hieu.nguyen)\
**Post date:** [March 25, 2026, 6:08am UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/4 "2026-03-25T06:08:52Z")

</div>

Hi @pkm2112,

Can you share the steps you’ve taken and the error log you received?

Below are my steps to configure the keyring with a global manifest, then switching to a local one, and it works without issue:

```bash
# create the global manifest file
cat <<EOF > /usr/sbin/mysqld.my
{
  "components": "file://component_keyring_file"
}
EOF

# create component_keyring_file config
cat <<EOF > /usr/lib64/mysql/plugin/component_keyring_file.cnf
{
  "path": "/var/lib/mysql-keyring/component_keyring_file",
  "read_only": true
}
EOF

# create enc keys dir
cd /var/lib
sudo mkdir mysql-keyring
sudo chown mysql:mysql mysql-keyring
sudo chmod 750 mysql-keyring

# restart service 
systemctl restart mysqld

# verify the component is loaded
mysql -pxxxxx -e 'SELECT * FROM performance_schema.keyring_component_status;'
mysql: [Warning] Using a password on the command line interface can be insecure.
+---------------------+-----------------------------------------------+
| STATUS_KEY | STATUS_VALUE |
+---------------------+-----------------------------------------------+
| Component_name | component_keyring_file |
| Author | Oracle Corporation |
| License | GPL |
| Implementation_name | component_keyring_file |
| Version | 1.0 |
| Component_status | Active |
| Data_file | /var/lib/mysql-keyring/component_keyring_file |
| Read_only | Yes |
+---------------------+-----------------------------------------------+
 

# create local manifest file
cp /usr/sbin/mysqld.my /var/lib/mysql/mysqld.my

# update global manifest to read local file
cat <<EOF > /usr/sbin/mysqld.my
{
  "read_local_manifest": true
}
EOF

# restart and check component load 
systemctl restart mysqld
mysql -pxxxxx -e 'SELECT * FROM performance_schema.keyring_component_status;'
mysql: [Warning] Using a password on the command line interface can be insecure.
+---------------------+-----------------------------------------------+
| STATUS_KEY | STATUS_VALUE |
+---------------------+-----------------------------------------------+
| Component_name | component_keyring_file |
| Author | Oracle Corporation |
| License | GPL |
| Implementation_name | component_keyring_file |
| Version | 1.0 |
| Component_status | Active |
| Data_file | /var/lib/mysql-keyring/component_keyring_file |
| Read_only | Yes |
+---------------------+-----------------------------------------------+
 

```

---

<div class="post-metadata">

**Author:** ![pkm2112](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/pkm2112/32/21433_2.png) [@pkm2112](https://forums.percona.com/u/pkm2112)\
**Post date:** [March 25, 2026, 8:19am UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/5 "2026-03-25T08:19:37Z")

</div>

It appears to me your configuration isn’t complete

component kerying file cnf located under lib/plugin shouldn’t contain path of keystore.

cnf file containing path of keystore is supposed to b under datadir

Objective : u could run multiple instances from same home each with different keystore

Stuff works for me as expected if I run “oracle” mysql . Currently I’m supporting '“oracle” mysql instances in production

Cheers

---

<div class="post-metadata">

**Author:** ![hieu.nguyen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/hieu.nguyen/32/21872_2.png) [@hieu.nguyen](https://forums.percona.com/u/hieu.nguyen)\
**Post date:** [March 25, 2026, 9:36am UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/6 "2026-03-25T09:36:25Z")

</div>

hi @pkm2112,

Below is my deployment with the local keyring config file, and it still works:

```bash
cat <<EOF > /usr/sbin/mysqld.my
{
  "read_local_manifest": true
}
EOF
cat <<EOF > /usr/lib64/mysql/plugin/component_keyring_file.cnf
{
  "read_local_config": true 
}
EOF

for i in {1..2}
do 
cat <<EOF > "/usr/local/mysql${i}/data/mysqld.my"
{
  "components": "file://component_keyring_file"
}
EOF
cat <<EOF > "/usr/local/mysql${i}/data/component_keyring_file.cnf"
{
  "path": "/var/lib/mysql-keyring/component_keyring_file-${i}",
  "read_only": true
}
EOF
done 

```

Retarting and querying each instance shows them using different keyring `Data_file`

```bash
for i in {6..7}
do 
  mysql --host=127.0.0.1 --port=330${i} -pxxxxx -e 'SELECT * FROM performance_schema.keyring_component_status;'
done 
mysql: [Warning] Using a password on the command line interface can be insecure.
+---------------------+-------------------------------------------------+
| STATUS_KEY | STATUS_VALUE |
+---------------------+-------------------------------------------------+
| Component_name | component_keyring_file |
| Author | Oracle Corporation |
| License | GPL |
| Implementation_name | component_keyring_file |
| Version | 1.0 |
| Component_status | Active |
| Data_file | /var/lib/mysql-keyring/component_keyring_file-1 |
| Read_only | Yes |
+---------------------+-------------------------------------------------+
mysql: [Warning] Using a password on the command line interface can be insecure.
+---------------------+-------------------------------------------------+
| STATUS_KEY | STATUS_VALUE |
+---------------------+-------------------------------------------------+
| Component_name | component_keyring_file |
| Author | Oracle Corporation |
| License | GPL |
| Implementation_name | component_keyring_file |
| Version | 1.0 |
| Component_status | Active |
| Data_file | /var/lib/mysql-keyring/component_keyring_file-2 |
| Read_only | Yes |
+---------------------+-------------------------------------------------+

```

I’m testing with Percona’s MySQL Server 8.4.6 (`percona-server-server-8.4.s6-6.1.el9.aarch64`), and the instance’s config file is pretty bare-bones:

```auto
[mysqld]
basedir=/usr/local/mysql2
datadir=/usr/local/mysql2/data
socket=/usr/local/mysql2/mysql.sock
port=3307
log-error=/usr/local/mysql2/mysqld.log
pid-file=/usr/local/mysql2/mysqld.pid

```

---

<div class="post-metadata">

**Author:** ![Wayne\_Leutwyler](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/wayne_leutwyler/32/20829_2.png) [@Wayne\_Leutwyler](https://forums.percona.com/u/Wayne_Leutwyler)\
**Post date:** [March 25, 2026, 12:32pm UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/7 "2026-03-25T12:32:25Z")

</div>

I’ve been able to switch back and fourth between the global and local manifest files. I’ve not encountered any issues. I’m currently running Percona Server 8.4.8. Just as a sanity check I followed the steps that @hieu.nguyen shared.

---

<div class="post-metadata">

**Author:** ![pkm2112](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/pkm2112/32/21433_2.png) [@pkm2112](https://forums.percona.com/u/pkm2112)\
**Post date:** [March 25, 2026, 5:20pm UTC](https://forums.percona.com/t/configuring-the-component-keyring-in-percona-server-and-pxc-percona-community/40047/8 "2026-03-25T17:20:01Z")

</div>

Thanx for the information. My configuration is same as yours. I’m runnin percona 8.4.6 unpacked from tarball. I’ll try 8.4.8

Cheers