0

I am trying to set up tablespace encryption in MySQL 8.3 and I can activate the keyring-file plugin. The plugin, however, throws a deprecation notice suggesting migration to component_keyring_file. I tried to set it up as such but failed with a generic error without any further hints of what I did wrong.

Component component_keyring_file reported: 'The component is not initialized properly. Make sure that configuration is proper and use ALTER INSTANCE RELOAD KEYRING to reinitialize the component.'

Have any of the experts here managed to set the plugin up successfully, alternatively - is it possible to get a more in-depth error from MySQL as Note level logs are also of no help? I've tried looking at the official docs here and here, but was unable to find what I am doing wrong.

Dockerfile:

FROM mysql:latest

RUN mkdir -p /var/lib/mysql-keyring/component_keyring_file

COPY ./conf/mysqld.my /usr/sbin/mysqld.my

COPY ./conf/component_keyring_file.cnf /usr/lib64/mysql/plugin/component_keyring_file.cnf

RUN /bin/bash -c 'chown root:mysql /usr/sbin/mysqld.my ; chmod 644 /usr/sbin/mysqld.my'

mysqld.my file:

{ "components": "file://component_keyring_file" }

component_keyring_file.cnf file

{"path": "/var/lib/mysql-keyring/component_keyring_file", "read_only": false }

docker-compose file

version: '3.8'

services:
  mysql:
    image: mysql:latest
    build:
      context: .
      dockerfile: Dockerfile
    container_name: mysql_test
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: db1
      MYSQL_USER: user
      MYSQL_PASSWORD: password
    ports:
      - "3306:3306"

1 Answer 1

0

As someone who was investigating how to set this up myself, I was having similar problems. Looking at your Dockerfile, you have the command:

RUN mkdir -p /var/lib/mysql-keyring/component_keyring_file

This creates a directory of "component_keyring_file" when it should be a file.

You want to change it to the following:

RUN mkdir -p /var/lib/mysql-keyring/`
RUN touch /var/lib/mysql-keyring/component_keyring_file

this will create the folder structure if it doesn't already exist, and then create the file.

An easier way might to be to create a docker-compose script which just references the various component keyring files as volumes. The values in curly brackets are either replaced by the values of the files on your volume, or are environment variables - but this is outside the scope of DBA answers!

  mysqldb:
    container_name: MySQLDB
    image: ${MYSQL_IMAGE}
    networks:
      atlassian-bridge:
        ipv4_address: ${MYSQL_IP_ADDRESS}
    cap_add:
      - sys_nice
    ports:
      - '3306:3306'
    restart: unless-stopped
    volumes:
      - ${MYSQL_ENCRYPT_MANIFEST}:/usr/sbin/mysqld.my:ro
      - ${MYSQL_ENCRYPT_CONFIG}:/usr/lib64/mysql/plugin/component_keyring_file.cnf:rw
      - ${MYSQL_ENCRYPT_KEY}:/var/lib/mysql-keyring/component_keyring_file:rw
New contributor
Matthew is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.