MySQL Migration from Keyring Plugin to Keyring Component [MY-011084] [Server] Keyring migration failed

Question

For MySQL 8.0.40 on Rocky Linux, my database currently uses the keyring plugin. I want to migrate to the keyring component. It shows

[ERROR] [MY-013106] [Server] Can not perform keyring migration : Failed to initialize destination keyring.

I am working from these resources:

• https://dev.mysql.com/doc/refman/8.0/en/keyring-key-migration.html
• https://blogs.oracle.com/mysql/post/keyring-components
• https://bugs.mysql.com/bug.php?id=108197

I see someone had success setting encryption off, but I would like to avoid that.

I created the manifest: /usr/sbin/mysqld.my. It contains:

    {
      "components": "file://component_keyring_file"
    }

I checked that the component file exists:

ls /usr/lib64/mysql/plugin/component_keyring_file.so #success

I created the keyring configuration file: **/usr/lib64/mysql/plugin/component_keyring_file.cnf**. It reads:

    {
      "path": "/var/lib/mysql/mysql-keyring/component_keyring_file",
      "read_only": false
    }

I created the directory for the keyring file:

    mkdir /var/lib/mysql/mysql-keyring
    chown mysql:mysql /var/lib/mysql/mysql-keyring

After that, I stopped mysqld and tried to run the migration server. I have tried variations:

    mysqld --user=mysql --defaults-file=/etc/my.cnf --keyring-migration-to-component  --keyring-migration-source=keyring_file.so  --keyring-migration-destination=component_keyring_file.so
    
    mysqld --user=mysql --keyring-migration-to-component  --keyring-migration-source=keyring_file.so  --keyring-migration-destination=component_keyring_file.so

I understand that the migrating user cannot be root, so the user is mysql. Also, the component_keyring_file cannot be in the data directory. I have tried two paths:

/var/lib/mysql/mysql-keyring # dir for mysql files

/var/lib/mysql-keyring

I updated component_keyring_file.cnf and made sure the mysql user owned the directory.

Answer 1

I was not able to run the migration from the command line. It returned errors like

[MV-013106] [Server] Can not perform keyring migration : Failed to initialize destination keyring.

I performed these steps to remove the keyring_file encryption, then enable the component keyfile encryption. This answer guided me.

1. Disable encryption for each table using a script.
2. Edit /etc/my.cnf to remove the early-plugin-load=keyring_file.so directive.
3. Enable the component encryption:

• Add the file component_keyring_file.cnf
• Check ownership and write permissions on /var/lib/mysql-keyring/component_keyring_file.
• Add the manifest, /usr/sbin/mysqld.my

4. Restart the database and check the service status.

5. Check the keyring component status.

   SELECT * FROM performance_schema.keyring_component_status;

6. Enable encryption on each table using a script.

Script to generate Disable Encryption statements for a database.

SELECT
-- table_schema, table_name, table_type,
CONCAT( 'ALTER table `', table_name, '` ENCRYPTION = ''N''; ') AS alter_table
FROM information_schema.TABLES WHERE table_schema = 'database_name' AND table_type ='BASE TABLE';

Script to generate Enable Encryption statements for a database.

SELECT CONCAT( 'ALTER table `', table_name, '` ENCRYPTION = ''Y''; ') AS alter_table
FROM information_schema.TABLES WHERE table_schema = 'database_name' AND table_type ='BASE TABLE';