Data at rest Encryption issue - MySQL 8.0.23

MySQL & MariaDB Percona Server for MySQL 8.0
, , , ,
1

Hi,

I am trying to enable Data at rest Encryption for mysql 8.0.23 version percona server innodb cluster.

used below hashicorp vault details in keyring_vault.conf for all the 3 nodes with diff secret_mount_point details.

**vault_url = <vaulturl>**
**secret_mount_point = secret/mysql/poc**
**secret_mount_point_version = 2**
**token = *********************
**vault_ca = /mysql/ca.pem**

getting below errors in logfile when i try to start

2021-06-08T08:58:07.161680Z 0 [Warning] [MY-011197] [Server] Plugin keyring_vault reported: 'Probing secret for being a mount point unsuccessful - skipped.'
2021-06-08T08:58:07.177507Z 0 [Warning] [MY-011197] [Server] Plugin keyring_vault reported: 'Probing secret/mysql for being a mount point unsuccessful - skipped.'
2021-06-08T08:58:07.192492Z 0 [Warning] [MY-011197] [Server] Plugin keyring_vault reported: 'Probing secret/mysql/poc for being a mount point unsuccessful - skipped.'
2021-06-08T08:58:07.192547Z 0 [System] [MY-011197] [Server] Plugin keyring_vault reported: 'Auto-detected mount point version is not the same as specified in 'secret_mount_point_version'.'
2021-06-08T08:58:07.192603Z 0 [System] [MY-011197] [Server] Plugin keyring_vault reported: 'keyring_vault initialization failure. Please check that the keyring_vault_config_file points to readable keyring_vault configuration file. Please also make sure Vault is running and accessible. The keyring_vault will stay unusable until correct configuration file gets provided.'

config option:

**[mysqld]**
**early-plugin-load="keyring_vault=keyring_vault.so"**
**loose-keyring_vault_config=/mysql/keyring_vault.conf**

Any inputs on how to use vault config properly for engine version2.

Note: Namespace is enabled in vault . when i try to get keys from API  *<vault_url>/v1/secret/metadata/mysql/poc?list=True* works fine.

with same details
~Adithya

2

Vault config:

vault_url = <vault_url>
secret_mount_point = secret/mysql/poc
secret_mount_point_version = 2
token = *********************
vault_ca = /mysql/ca.pem

3

Adithya or anyone, I just started to use Vault. I am wondering if you have solved or know the correct format of secret_mount_point for kv version 2. I am having the same issue. I’ve tried secret, secret/kv, kv prefixes and nothing. Each resulted in the error message.

Also the token is much longer than the one in the tutorial provided by Percona, in the format of hvs.xxxxx–xxxxxxxxxxxxxxxxxx. I suppose I just put the whole thing for the token value.

Corresponding policy:

path “kv/” {
capabilities = [“list”]
}

path “kv/data/pxc/*” {
capabilities = [“create”, “read”, “update”, “delete”, “list”]
}

I tested in UI that the token can access pxc/keying1, pxc/keyring2 and so on. CLI, such as vault kv get -mount=kv pxc/keyring2 works too.

Thanks.

1 Like
4

Hi! I think that with Key Value v2 the correct policy is this (considering secret_mount_point=kv/pxc/keyring1):

path "kv/config" {
  capabilities = ["read"]
}

path "kv/metadata/pxc/*" {
  capabilities = ["list"]
}

path "kv/data/pxc/*" {
  capabilities = ["create", "read", "delete", "update", "list"]
}
2 Likes
5

@DanyUP84, thanks a lot for the reply. It works now.

1 Like