# What is the recommended way to rotate vault token for mysql?

**URL:** <https://forums.percona.com/t/what-is-the-recommended-way-to-rotate-vault-token-for-mysql/40864>\
**Category:** Percona XtraDB Cluster 8.x\
**Tags:** percona\
**Created:** [June 2, 2026, 9:21am UTC](https://forums.percona.com/t/what-is-the-recommended-way-to-rotate-vault-token-for-mysql/40864 "2026-06-02T09:21:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yash\_Daga](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yash_daga/32/22569_2.png) [@Yash\_Daga](https://forums.percona.com/u/Yash_Daga)\
**Post date:** [June 2, 2026, 9:21am UTC](https://forums.percona.com/t/what-is-the-recommended-way-to-rotate-vault-token-for-mysql/40864/1 "2026-06-02T09:21:56Z")

</div>

I want to rotate the vault token inside the keyring.conf file, but I was concerned that if mysql only reads the token at startup and stores it in memory, how would it know when to read a fresh token from the keyring.conf file after the token has expired.

I found [Best Practice for Automatic Vault Token Generation and Percona keyring\_vault plugin - #2 by LukeYangJMA](https://forums.percona.com/t/best-practice-for-automatic-vault-token-generation-and-percona-keyring-vault-plugin/16219/2) which mentions that we can run:

```auto
mysql> UNINSTALL PLUGIN keyring_vault;
mysql> INSTALL PLUGIN keyring_vault SONAME 'keyring_vault.so';

```

to refresh the token loaded in memory.

i wanted to ask if this is the best way to handle token rotation or is there something else as well?

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [June 2, 2026, 5:15pm UTC](https://forums.percona.com/t/what-is-the-recommended-way-to-rotate-vault-token-for-mysql/40864/2 "2026-06-02T17:15:13Z")

</div>

Hello @Yash_Daga,  
Since there is no built-in function to reload the keyring config, you’ll have to uninstall the plugin, then reinstall it to force a reload. You can open a feature request at [https://jira.percona.com](https://jira.percona.com) for a native function to be added to the plugin.

---

<div class="post-metadata">

**Author:** ![Yash\_Daga](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yash_daga/32/22569_2.png) [@Yash\_Daga](https://forums.percona.com/u/Yash_Daga)\
**Post date:** [June 3, 2026, 9:45am UTC](https://forums.percona.com/t/what-is-the-recommended-way-to-rotate-vault-token-for-mysql/40864/3 "2026-06-03T09:45:05Z")

</div>

Thanks for the quick response @matthewb, just wanted to ask if you have any recommended way of handling vault access to mysql, is it via tokens or by k8s service token auth?

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [June 4, 2026, 5:31pm UTC](https://forums.percona.com/t/what-is-the-recommended-way-to-rotate-vault-token-for-mysql/40864/4 "2026-06-04T17:31:24Z")

</div>

I believe the mysql plugin only supports direct tokens.