# How to mount keyring using extraPVC in percona 1.19.0 **URL:** \ **Category:** Percona Operator for MySQL\ **Created:** [January 21, 2026, 6:56am UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078 "2026-01-21T06:56:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Yash\_Daga](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yash_daga/32/22569_2.png) [@Yash\_Daga](https://forums.percona.com/u/Yash_Daga)\ **Post date:** [January 21, 2026, 6:56am UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078/1 "2026-01-21T06:56:17Z")
Hi I wanted to use extraPVCs feature[[PR/2276](https://github.com/percona/percona-xtradb-cluster-operator/pull/2276)] provided by 1.19.0 release to mount the keyring\_file for mysql data at rest encryption **on a 3 node cluster.** I wanted to ask since the extraPVCs do not support storage classes and PVC template, do you have any suggestions on how can we ensure that PVC is available to all 3 pxc pods and that mount is highly available? We were thinking of using longhorn or some other distributed block storage on k8s but wanted to ask if that’s the ideal solution? @matthewb @Ege_Gunes ---
**Author:** ![George\_Kechagias](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/george_kechagias/32/19802_2.png) [@George\_Kechagias](https://forums.percona.com/u/George_Kechagias)\ **Post date:** [January 21, 2026, 4:34pm UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078/2 "2026-01-21T16:34:14Z")
Hey @Yash_Daga The extraPVCs feature only mounts pre-existing PVCs by name. This means you need to create the PVCs yourself before deploying the feature. Then all the pods of the respective component you configured will have access to this PVC. So in that case, creating a StorageClass e.g. longhorn-rwx with replication configured and then creating a PVC with storageClassName: longhorn-rwx and accessMode: ReadWriteMany, should work. ---
**Author:** ![Yash\_Daga](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yash_daga/32/22569_2.png) [@Yash\_Daga](https://forums.percona.com/u/Yash_Daga)\ **Post date:** [January 29, 2026, 7:54pm UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078/3 "2026-01-29T19:54:30Z")
Hi @George_Kechagias, thanks for your response. I was trying to perform backup and restore using xtrabackup for encrypted InnoDB tables using keyring mounted as extraPVC. After taking backup I tried to restore into a cluster where I had loaded the previous cluster’s master keys in the same component\_keyring\_file mounted as extraPVC here as well. But the restore job was failing with `2026-01-28T05:07:06.494451-00:00 0 [ERROR] [MY-011825] [Xtrabackup] Error reading xtrabackup_keys: failed to derive encryption key` `2026-01-28T05:07:06.494502-00:00 0 [ERROR] [MY-011825] [Xtrabackup] failed to load tablespace keys` I figured that it was because the restore pod didn’t have the keyring file mounted, but I was not sure how can I mount it and also ensure that component\_keyring\_file config is also present there. It would be great if you could help me with this, I also tried using transition-key but was facing a different issue there [Cannot specify custom --transition-key for XtraBackup in Percona PXC Cluster](https://forums.percona.com/t/cannot-specify-custom-transition-key-for-xtrabackup-in-percona-pxc-cluster/40129) Thanks ---
**Author:** ![George\_Kechagias](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/george_kechagias/32/19802_2.png) [@George\_Kechagias](https://forums.percona.com/u/George_Kechagias)\ **Post date:** [January 30, 2026, 11:15am UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078/4 "2026-01-30T11:15:19Z")
Hey @Yash_Daga Right now, we are not mounting the extraPVC to the restore pods, but actually, this is a very nice improvement. We prepared a ticket for this, and we will try to pick upo this work as soon as possible. Have a look here: [Jira](https://perconadev.atlassian.net/browse/K8SPXC-1798) ---
**Author:** ![Yash\_Daga](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yash_daga/32/22569_2.png) [@Yash\_Daga](https://forums.percona.com/u/Yash_Daga)\ **Post date:** [January 30, 2026, 11:45am UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078/5 "2026-01-30T11:45:51Z")
Thanks @George_Kechagias for the quick response. Currently for [component\_keyring\_file installation](https://docs.percona.com/percona-server/8.0/using-keyring-plugin.html#use-the-keyring_file-component) we had to modify the cluster image to have a global manifest in the usr/sbin directory and keyring config file in usr/lib64/mysql/plugin directory. To use the [component keyring config](https://docs.percona.com/percona-xtrabackup/8.0/encrypted-innodb-tablespace-backups.html#prepare-the-backup-with-component-keyring-config) arg while applying restore, apart from the keyring file we would also need the config to be located somewhere in the restore pod. Can you suggest any way to ensure that? Is there an estimated time for the extraPVC feature to be available in restore pods? Actually we required it for a product with Feb end deadline, I can help by raising the PR. Thanks again for your support! ---
**Author:** ![George\_Kechagias](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/george_kechagias/32/19802_2.png) [@George\_Kechagias](https://forums.percona.com/u/George_Kechagias)\ **Post date:** [February 5, 2026, 12:00pm UTC](https://forums.percona.com/t/how-to-mount-keyring-using-extrapvc-in-percona-1-19-0/40078/6 "2026-02-05T12:00:24Z")
> Is there an estimated time for the extraPVC feature to be available in restore pods? Actually we required it for a product with Feb end deadline, I can help by raising the PR. Your contribution would be more than welcome! Keep in mind, though, that you might have to create a custom image yourself with the fix in order to use it immediately instead of waiting the next release.