# Is there any way to debug keyring\_vault plugin in pxc operator instance?

**URL:** <https://forums.percona.com/t/is-there-any-way-to-debug-keyring-vault-plugin-in-pxc-operator-instance/9671>\
**Category:** Percona Operator for MySQL\
**Created:** [March 16, 2021, 8:30am UTC](https://forums.percona.com/t/is-there-any-way-to-debug-keyring-vault-plugin-in-pxc-operator-instance/9671 "2021-03-16T08:30:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oleksandr\_Slubskyi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr_slubskyi/32/2751_2.png) [@Oleksandr\_Slubskyi](https://forums.percona.com/u/Oleksandr_Slubskyi)\
**Post date:** [March 16, 2021, 8:30am UTC](https://forums.percona.com/t/is-there-any-way-to-debug-keyring-vault-plugin-in-pxc-operator-instance/9671/1 "2021-03-16T08:30:40Z")

</div>

I’ve worked pxc (from helm chart 0.1.14) cluster (percona-kubernetes-operator 0.1.10). Currently I’m training to test a disaster recovery plan. I’ve created new cluster, restore Vault (HA Raft) from snapshot, but pxc can’t start:

```auto
[4] prod.pxc-db-pxc-0.mysqld-error.log: [1615882257.953232529, {"log"=>"2021-03-16T08:10:57.953042Z 0 [System] [MY-011197] [Server] Plugin keyring_vault reported: 'Could not retrieve list of keys from Vault.'"}]
[5] prod.pxc-db-pxc-0.mysqld-error.log: [1615882257.953342834, {"log"=>"2021-03-16T08:10:57.953267Z 0 [ERROR] [MY-011371] [Server] Plugin keyring_vault reported: 'Error while loading keyring content. The keyring might be malformed'"}]
[6] prod.pxc-db-pxc-0.mysqld-error.log: [1615882257.953395061, {"log"=>"2021-03-16T08:10:57.953336Z 0 [System] [MY-011197] [Server] Plugin keyring_vault reported: 'keyring_vault initialization failure. Please check that the keyring_vault_config_file points to readable keyring_vault configuration file. Please also make sure Vault is running and accessible. The keyring_vault will stay unusable until correct configuration file gets provided.'"}]

```

I’ve checked Vault token and permission from another sidecar container:

```auto
curl -H "X-Vault-Token: XXXXX" --cacert /tmp/vault.ca https://vault.prod.svc.cluster.local:8200/v1/pxc-secret/?list=true | jq 

```

return

```auto
{
  "request_id": "9e5caeac-c463-dfc3-bf0c-129ad6b3e8dc",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "keys": [
      "MTRfcGVyY29uYV9yZWRvOjAwXw==",
      "NDhfSU5OT0RCS2V5LTE4NDc0OGY1LTYzZTQtMTFlYi05NDE2LTFhNGVjZWJjYjliMi0xMF8=",
      "NDhfSU5OT0RCS2V5LTE4NDc0OGY1LTYzZTQtMTFlYi05NDE2LTFhNGVjZWJjYjliMi0yMF8=",
      "NDhfSU5OT0RCS2V5LTRiMmEwNWRkLTYzZTQtMTFlYi1hY2VhLTEyYmQ0MjZjZTA4Yi0xMF8=",
...

```

Thanks

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [March 24, 2021, 2:00pm UTC](https://forums.percona.com/t/is-there-any-way-to-debug-keyring-vault-plugin-in-pxc-operator-instance/9671/2 "2021-03-24T14:00:24Z")

</div>

Hello @Oleksandr_Slubskyi ,

could you pls check if the secret for Vault is present?

> <https://github.com/percona/percona-xtradb-cluster-operator/blob/main/deploy/cr.yaml#L14>

Is the secret correct?

What about the config itself - is it correctly restored? `/etc/mysql/vault-keyring-secret/keyring_vault.conf`