# Rotating vault token and master key, and backing up the vault keys?
**URL:** https://forums.percona.com/t/rotating-vault-token-and-master-key-and-backing-up-the-vault-keys/10105
**Category:** Percona Server for MySQL 8.0
**Tags:** percona, mysql, community
**Created:** [April 15, 2021, 11:57am UTC](https://forums.percona.com/t/rotating-vault-token-and-master-key-and-backing-up-the-vault-keys/10105 "2021-04-15T11:57:43Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Altin\_Ukshini](https://forums.percona.com/u/Altin_Ukshini)
#### Post date: [April 15, 2021, 11:57am UTC](https://forums.percona.com/t/rotating-vault-token-and-master-key-and-backing-up-the-vault-keys/10105/1 "2021-04-15T11:57:43Z")
Hi there,
I’ve successfully managed to configure Percona Server for MySql v8 with Vault and the keyring plugin.
I do have a few questions since I could not find them anywhere in the documentation pages:
**Q1: Vault unseal/seal**
Should vault remain unsealed at all times while running with Percona keyring plugin? Please give any context on this from you personal experience if you can.
**Q2: Token renewal**
The token that I generated in vault to be used in the **loose\_keyring\_vault\_config** file by default expires in 32days or less.
Do I have to renew this token at some point and if so how do you suggest to approach this in an automated or manual fashion (maybe a cron job that runs vault renew?), or should I create this token with an infinite duration (this doesn’t sound right)?
**Q3: Master key rotation**
Also related to Q2.
What is the procedure of rotating the master key, should percona be restarted every time the ALTER INSTANCE query is run? ([Rotating the Master Key — Percona Server 8.0 Documentation](https://percona.com/doc/percona-server/8.0/security/rotating-master-key.html#rotating-master-key)) If so, should we make sure that the token used to access vault is valid?
**Q4: Vault key backups**
I’m concerned about having a backup of these generated keys in Vault. How would you go around backing up these keys (master key and other table specific keys) in Vault? Any reference would be helpful.
Thank you very much in advance for your help!
---
### Author:  [@iamwel](https://forums.percona.com/u/iamwel)
#### Post date: [June 3, 2021, 5:26pm UTC](https://forums.percona.com/t/rotating-vault-token-and-master-key-and-backing-up-the-vault-keys/10105/2 "2021-06-03T17:26:07Z")
Great questions, Altin!
I am looking for some official guidance on this as well, so hoping the Percona team can point us to an article or some docs. I’m doing a few different kinds of backups of my PXC and Vault (RAFT backend) clusters, but I’m sure there’s a solution that makes better use of resources. Until there is official guidance, I’m defaulting to the “Backup all the things in all the possible ways.” philosophy 🙂
---
### Author:  [@Nehemia](https://forums.percona.com/u/Nehemia)
#### Post date: [June 7, 2021, 4:47pm UTC](https://forums.percona.com/t/rotating-vault-token-and-master-key-and-backing-up-the-vault-keys/10105/3 "2021-06-07T16:47:21Z")
I must say that I have the same questions myself
It would be great if someone will supply and the official best practices
---
### Author:  [@Nehemia](https://forums.percona.com/u/Nehemia)
#### Post date: [June 15, 2021, 8:22am UTC](https://forums.percona.com/t/rotating-vault-token-and-master-key-and-backing-up-the-vault-keys/10105/4 "2021-06-15T08:22:28Z")
I found the following links it relates more to K8S but I guess it can be done on other environments
I still would like to hear if this is the best way to go
Basically, the idea is to install a Vault agent that will be responsible for the vault token rotation
As to the master key, could not find how to do it with vault and automatically
> **[Vault Agent with Kubernetes | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/agent-kubernetes?in=vault%2Fkubernetes)**
>
> This tutorial demonstrates the Auto-Auth method of Vault Agent using Kubernetes
> auth method on the server side.
> **[Vault Agent | Vault by HashiCorp](https://www.vaultproject.io/docs/agent)**
>
> Vault Agent is a client-side daemon that can be used to perform some Vault
> functionality automatically.
> **[Vault Agent Template | Vault by HashiCorp](https://www.vaultproject.io/docs/agent/template)**
>
> Vault Agent's Template functionality allows Vault secrets to be rendered to files using Consul Template markup.
[https://www.percona.com/doc/percona-server/8.0/security/rotating-master-key.html](https://www.percona.com/doc/percona-server/8.0/security/rotating-master-key.html)
> **[MySQL Encryption: How Master Key Rotation Works - Percona Database...](https://www.percona.com/blog/2020/02/19/mysql-encryption-how-master-key-rotation-works/)**
>
> For Master Key encryption in MySQL, Master Key rotation works by generating a new Master Key to re-encrypt the tablespace key (stored in tablespace’s header).