# Data at Rest Encryption questions

**URL:** <https://forums.percona.com/t/data-at-rest-encryption-questions/13765>\
**Category:** Percona Operator for MySQL\
**Tags:** mysql, percona\
**Created:** [January 4, 2022, 9:55am UTC](https://forums.percona.com/t/data-at-rest-encryption-questions/13765 "2022-01-04T09:55:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![katajistok](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@katajistok](https://forums.percona.com/u/katajistok)\
**Post date:** [January 4, 2022, 9:55am UTC](https://forums.percona.com/t/data-at-rest-encryption-questions/13765/1 "2022-01-04T09:55:26Z")

</div>

Hello!

1. On HashiCorp Vault there is token auto renewal feature. Is this supported with XtraDB?
2. Can Data at Rest Encryption enabled on-the-fly, when database is already in-use? What is expected to happen?

Thank you for responses.

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [January 11, 2022, 7:57am UTC](https://forums.percona.com/t/data-at-rest-encryption-questions/13765/2 "2022-01-11T07:57:01Z")

</div>

Hello @katajistok ,

1. No, it is not supported. It is the way keyring plugin works.
2. You cannot enable it on the fly. There are some tricks to make it work, but not so straightforward. We will see if these steps can be automated through the operator.

---

<div class="post-metadata">

**Author:** ![katajistok](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@katajistok](https://forums.percona.com/u/katajistok)\
**Post date:** [January 19, 2022, 7:39am UTC](https://forums.percona.com/t/data-at-rest-encryption-questions/13765/3 "2022-01-19T07:39:31Z")

</div>

One more question related to encryption at rest. How we should encrypt database when customer has the database on another system and it should be then restored to XtraDB?  
Is it so that we should do things in this order:

1. create XtraDB (with encryption at rest enabled)
2. restore database from storage

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [January 19, 2022, 11:19am UTC](https://forums.percona.com/t/data-at-rest-encryption-questions/13765/4 "2022-01-19T11:19:26Z")

</div>

@katajistok I think yes, this should work.