How to migrate Secret Keys generated by component_keyring_vault from HashiCorp Vault to Azure Key Vault?

MySQL & MariaDB Percona XtraDB Cluster 8.x
1

Hello colleagues,

We currently use component_keyring_vault to manage encryption keys for Percona XtraDB Cluster with HashiCorp Vault.

We are planning to migrate from HashiCorp Vault to Azure Key Vault. However, according to the Percona Server for MySQL documentation, Percona does not currently provide a native component_keyring component for Azure Key Vault.

We have the following options:

image
image872×494 58.6 KB

Option A — Develop a custom component_keyring for Azure Key Vault

This would require us to develop and maintain our own keyring component for AKV. We consider this approach risky because implementing a keyring component requires deep knowledge of the Percona/MySQL keyring architecture and careful handling of encryption keys. A mistake could potentially result in losing access to encrypted data.

Option C — Use KMIP

Percona provides integration with KMIP-compatible key management systems. However, according to the Percona documentation, the supported integrations are with Thales and Fortanix (KMS themselves), while PyKMIP does not provide integration with Azure Key Vault.

Therefore, we are looking for recommendations on how to migrate our existing keys from HashiCorp Vault to Azure Key Vault without losing access to the existing encrypted data.

Has anyone successfully implemented a similar migration, or is there a Percona-supported approach that we are missing?

2

Hello @matthewb ,

Is there a planned component_keyring_azure implementation for Percona Server for MySQL 8.4, providing native integration with Azure Key Vault? If yes, is there an estimated release/version? If not, what integration with Azure Key Vault does Percona recommend for TDE and Percona XtraBackup?

3

@Sergey_Ogurtsov I opened this feature request for Azure KMS support in March 2023. It has no activity since. I do not believe it is high on our priority roadmap. If you have a support contract with us, please open a ticket requesting this so it can be pushed up the chain.