# Data at rest Encryption issue - MySQL 8.0.23

**URL:** https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785
**Category:** Percona Server for MySQL 8.0
**Tags:** new-release, percona, troubleshooting, mysql, community
**Created:** [June 8, 2021, 9:08am UTC](https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785 "2021-06-08T09:08:48Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Adithya](https://avatars.discourse-cdn.com/v4/letter/a/e99b99/32.png) [@Adithya](https://forums.percona.com/u/Adithya)
#### Post date: [June 8, 2021, 9:08am UTC](https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785/1 "2021-06-08T09:08:48Z")

</div>

Hi,

I am trying to enable Data at rest Encryption for mysql 8.0.23 version percona server innodb cluster.

used below hashicorp vault details in keyring\_vault.conf for all the 3 nodes with diff secret\_mount\_point details.

```auto
**vault_url = <vaulturl>**
 **secret_mount_point = secret/mysql/poc**
 **secret_mount_point_version = 2**
 **token =*********************
 **vault_ca = /mysql/ca.pem**

```

getting below errors in logfile when i try to start

```auto
2021-06-08T08:58:07.161680Z 0 [Warning] [MY-011197] [Server] Plugin keyring_vault reported: 'Probing secret for being a mount point unsuccessful - skipped.'
2021-06-08T08:58:07.177507Z 0 [Warning] [MY-011197] [Server] Plugin keyring_vault reported: 'Probing secret/mysql for being a mount point unsuccessful - skipped.'
2021-06-08T08:58:07.192492Z 0 [Warning] [MY-011197] [Server] Plugin keyring_vault reported: 'Probing secret/mysql/poc for being a mount point unsuccessful - skipped.'
2021-06-08T08:58:07.192547Z 0 [System] [MY-011197] [Server] Plugin keyring_vault reported: 'Auto-detected mount point version is not the same as specified in 'secret_mount_point_version'.'
2021-06-08T08:58:07.192603Z 0 [System] [MY-011197] [Server] Plugin keyring_vault reported: 'keyring_vault initialization failure. Please check that the keyring_vault_config_file points to readable keyring_vault configuration file. Please also make sure Vault is running and accessible. The keyring_vault will stay unusable until correct configuration file gets provided.'

```

config option:

```auto
**[mysqld]**
 **early-plugin-load="keyring_vault=keyring_vault.so"**
 **loose-keyring_vault_config=/mysql/keyring_vault.conf**

```

Any inputs on how to use vault config properly for engine version2.

```auto
Note: Namespace is enabled in vault . when i try to get keys from API *<vault_url>/v1/secret/metadata/mysql/poc?list=True* works fine.

```

with same details  
~Adithya

---

<div class="post-metadata">

### Author: ![Adithya](https://avatars.discourse-cdn.com/v4/letter/a/e99b99/32.png) [@Adithya](https://forums.percona.com/u/Adithya)
#### Post date: [June 8, 2021, 9:10am UTC](https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785/2 "2021-06-08T09:10:15Z")

</div>

> [@Adithya](#):
>
> **vault\_url =**  
> **secret\_mount\_point = secret/mysql/poc**  
> **secret\_mount\_point\_version = 2**  
> \*\*token = \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> **vault\_ca = /mysql/ca.pem**

Vault config:

vault\_url = \<vault\_url\>  
secret\_mount\_point = secret/mysql/poc  
secret\_mount\_point\_version = 2  
token = \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
vault\_ca = /mysql/ca.pem

---

<div class="post-metadata">

### Author: ![eshmh](https://avatars.discourse-cdn.com/v4/letter/e/bb73d2/32.png) [@eshmh](https://forums.percona.com/u/eshmh)
#### Post date: [October 30, 2022, 1:54am UTC](https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785/3 "2022-10-30T01:54:59Z")

</div>

[Adithya](https://forums.percona.com/u/Adithya) or anyone, I just started to use Vault. I am wondering if you have solved or know the correct format of secret\_mount\_point for kv version 2. I am having the same issue. I’ve tried secret, secret/kv, kv prefixes and nothing. Each resulted in the error message.

Also the token is much longer than the one in the tutorial provided by Percona, in the format of hvs.xxxxx–xxxxxxxxxxxxxxxxxx. I suppose I just put the whole thing for the token value.

Corresponding policy:

path “kv/” {  
capabilities = [“list”]  
}

path “kv/data/pxc/\*” {  
capabilities = [“create”, “read”, “update”, “delete”, “list”]  
}

I tested in UI that the token can access pxc/keying1, pxc/keyring2 and so on. CLI, such as vault kv get -mount=kv pxc/keyring2 works too.

Thanks.

---

<div class="post-metadata">

### Author: ![DanyUP84](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@DanyUP84](https://forums.percona.com/u/DanyUP84)
#### Post date: [November 13, 2022, 5:53pm UTC](https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785/4 "2022-11-13T17:53:03Z")

</div>

Hi! I think that with Key Value v2 the correct policy is this (considering secret\_mount\_point=kv/pxc/keyring1):

```auto
path "kv/config" {
  capabilities = ["read"]
}

path "kv/metadata/pxc/*" {
  capabilities = ["list"]
}

path "kv/data/pxc/*" {
  capabilities = ["create", "read", "delete", "update", "list"]
}

```

---

<div class="post-metadata">

### Author: ![eshmh](https://avatars.discourse-cdn.com/v4/letter/e/bb73d2/32.png) [@eshmh](https://forums.percona.com/u/eshmh)
#### Post date: [November 14, 2022, 12:56am UTC](https://forums.percona.com/t/data-at-rest-encryption-issue-mysql-8-0-23/10785/5 "2022-11-14T00:56:08Z")

</div>

@DanyUP84, thanks a lot for the reply. It works now.