What is the recommended way to rotate vault token for mysql?

MySQL & MariaDB Percona XtraDB Cluster 8.x
1

I want to rotate the vault token inside the keyring.conf file, but I was concerned that if mysql only reads the token at startup and stores it in memory, how would it know when to read a fresh token from the keyring.conf file after the token has expired.

I found Best Practice for Automatic Vault Token Generation and Percona keyring_vault plugin - #2 by LukeYangJMA which mentions that we can run:

mysql> UNINSTALL PLUGIN keyring_vault;
mysql> INSTALL PLUGIN keyring_vault SONAME 'keyring_vault.so';

to refresh the token loaded in memory.

i wanted to ask if this is the best way to handle token rotation or is there something else as well?

2

Hello @Yash_Daga,
Since there is no built-in function to reload the keyring config, you’ll have to uninstall the plugin, then reinstall it to force a reload. You can open a feature request at https://jira.percona.com for a native function to be added to the plugin.

3

Thanks for the quick response @matthewb, just wanted to ask if you have any recommended way of handling vault access to mysql, is it via tokens or by k8s service token auth?

4

I believe the mysql plugin only supports direct tokens.