content_image/671244.jpg content_image/671259.jpg
} 

<img src='content_image/671244.jpg'>

## Note 

kv/mysql/  in this example may need adjustment per your local installation policies and security requirements. If so, make the same adjustment wherever else kv/mysql/  appears in these instructions. 

Import the policy file to the Vault server to create a policy named mysql-policy , then assign the policy to the new role: 

vault policy write mysql-policy mysql.hcl vault write auth/approle/role/mysql policies=mysql-policy 

Obtain the ID of the newly created role and store it in a secure location: 

vault read auth/approle/role/mysql/role-id 

Generate a secret ID for the role and store it in a secure location: 

vault write -f auth/approle/role/mysql/secret-id 

After these AppRole role ID and secret ID credentials are generated, they are expected to remain valid indefinitely. They need not be generated again and the keyring_hashicorp  plugin can be configured with them for use on an ongoing basis. For more information about AuthRole authentication, visit https://www.vaultproject.io/docs/auth/approle.html. 

## keyring_hashicorp Configuration 

The plugin library file contains the keyring_hashicorp  plugin and a loadable function, keyring_hashicorp_update_config() . When the plugin initializes and terminates, it automatically loads and unloads the function. There is no need to load and unload the function manually. 

The keyring_hashicorp  plugin supports the configuration parameters shown in the following table. To specify these parameters, assign values to the corresponding system variables. 

<img src='content_image/671259.jpg'>

To be usable during the server startup process, keyring_hashicorp  must be loaded using the -- early-plugin-load  option. As indicated by the preceding table, several plugin-related system variables are mandatory and must also be set. For example, use these lines in the server my.cnf  file, adjusting the .so  suffix and file locations for your platform as necessary: 

[mysqld] early-plugin-load=keyring_hashicorp.so keyring_hashicorp_role_id=’ee3b495c-d0c9-11e9-8881-8444c71c32aa’ keyring_hashicorp_secret_id=’0512af29-d0ca-11e9-95ee-0010e00dd718’ keyring_hashicorp_store_path=’/v1/kv/mysql’ keyring_hashicorp_auth_path=’/v1/auth/approle/login’ 

