# Cron Job / Event Scheduler for Vault Token Rotation

**URL:** <https://forums.percona.com/t/cron-job-event-scheduler-for-vault-token-rotation/16351>\
**Category:** Percona Server for MySQL 8.0\
**Tags:** closed-no-reply\
**Created:** [June 28, 2022, 7:15pm UTC](https://forums.percona.com/t/cron-job-event-scheduler-for-vault-token-rotation/16351 "2022-06-28T19:15:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![LukeYangJMA](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LukeYangJMA](https://forums.percona.com/u/LukeYangJMA)\
**Post date:** [June 28, 2022, 7:15pm UTC](https://forums.percona.com/t/cron-job-event-scheduler-for-vault-token-rotation/16351/1 "2022-06-28T19:15:27Z")

</div>

With reference to a [previous post](https://forums.percona.com/t/best-practice-for-automatic-vault-token-generation-and-percona-keyring-vault-plugin/16219/2) we wrote and solved, we are now looking to implement automatic Vault Token renewal using Vault Agent and potentially a cron job or the event scheduler built into MySQL.

In order to inject the new token generated by Vault Agent into the keyring\_vault.conf file, a cron job will be needed to automatically change the file. For the token change to take place, Percona will need to uninstall and then install the keyring\_vault plugin, which can be done through the event scheduler. The only problem we have right now is that while we can technically time the event scheduler to be after the cron job to avoid reinstalling the plugin before the token has changed, we would feel better if there was a more concrete way to establish a dependency between the cron job finishing and the event scheduler starting.

An immediate idea is to do the plugin reinstall from a cron job as well (granting INSERT and DELETE on the `mysql.plugin` system table), but it just doesn’t seem favourable providing the cron job with a mysql user and password. Does anyone have any suggestions on better ways to accomplish this?