# How to migrate Secret Keys generated by component\_keyring\_vault from HashiCorp Vault to Azure Key Vault? **URL:** \ **Category:** Percona XtraDB Cluster 8.x\ **Tags:** percona\ **Created:** [August 17, 2026, 4:48pm UTC](https://forums.percona.com/t/how-to-migrate-secret-keys-generated-by-component-keyring-vault-from-hashicorp-vault-to-azure-key-vault/41175 "2026-08-17T16:48:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Sergey\_Ogurtsov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_ogurtsov/32/21099_2.png) [@Sergey\_Ogurtsov](https://forums.percona.com/u/Sergey_Ogurtsov)\ **Post date:** [August 17, 2026, 4:48pm UTC](https://forums.percona.com/t/how-to-migrate-secret-keys-generated-by-component-keyring-vault-from-hashicorp-vault-to-azure-key-vault/41175/1 "2026-08-17T16:48:47Z")
Hello colleagues, We currently use `component_keyring_vault` to manage encryption keys for Percona XtraDB Cluster with HashiCorp Vault. We are planning to migrate from HashiCorp Vault to Azure Key Vault. However, according to the [Percona Server for MySQL documentation](https://docs.percona.com/percona-server/8.4/keyring-components-plugins-overview.html), Percona does not currently provide a native `component_keyring` component for Azure Key Vault. We have the following options: ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/1/d/1dc2473a0e9624cba18b35f0c8473f1ab05e0c91.png) **Option A — Develop a custom `component_keyring` for Azure Key Vault** This would require us to develop and maintain our own keyring component for AKV. We consider this approach risky because implementing a keyring component requires deep knowledge of the Percona/MySQL keyring architecture and careful handling of encryption keys. A mistake could potentially result in losing access to encrypted data. **Option C — Use KMIP** Percona provides integration with KMIP-compatible key management systems. However, according to the [Percona documentation](https://docs.percona.com/percona-server/8.4/using-kmip.html), the supported integrations are with Thales and Fortanix (KMS themselves), while PyKMIP does not provide integration with Azure Key Vault. Therefore, we are looking for recommendations on how to migrate our existing keys from HashiCorp Vault to Azure Key Vault without losing access to the existing encrypted data. Has anyone successfully implemented a similar migration, or is there a Percona-supported approach that we are missing? ---
**Author:** ![Sergey\_Ogurtsov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_ogurtsov/32/21099_2.png) [@Sergey\_Ogurtsov](https://forums.percona.com/u/Sergey_Ogurtsov)\ **Post date:** [August 18, 2026, 7:29am UTC](https://forums.percona.com/t/how-to-migrate-secret-keys-generated-by-component-keyring-vault-from-hashicorp-vault-to-azure-key-vault/41175/2 "2026-08-18T07:29:45Z")
Hello @matthewb , Is there a planned `component_keyring_azure` implementation for Percona Server for MySQL 8.4, providing native integration with Azure Key Vault? If yes, is there an estimated release/version? If not, what integration with Azure Key Vault does Percona recommend for TDE and Percona XtraBackup? ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [August 18, 2026, 2:56pm UTC](https://forums.percona.com/t/how-to-migrate-secret-keys-generated-by-component-keyring-vault-from-hashicorp-vault-to-azure-key-vault/41175/3 "2026-08-18T14:56:10Z")
@Sergey_Ogurtsov I opened this [feature request](https://perconadev.atlassian.net/browse/PS-8695) for Azure KMS support in March 2023. It has no activity since. I do not believe it is high on our priority roadmap. If you have a support contract with us, please open a ticket requesting this so it can be pushed up the chain.