engine uses the keyring for tablespace encryption, so a keyring component or plugin must be loaded and available prior to InnoDB  initialization. 

Unlike keyring plugins, keyring components are not loaded using the --early-plugin-load  server option or configured using system variables. Instead, the server determines which keyring component to load during startup using a manifest, and the loaded component consults its own configuration file when it initializes. Therefore, to install a keyring component, you must: 

1. Write a manifest that tells the server which keyring component to load. 

2. Write a configuration file for that keyring component. 

The first step in installing a keyring component is writing a manifest that indicates which component to load. During startup, the server reads either a global manifest file, or a global manifest file paired with a local manifest file: 

•The server attempts to read its global manifest file from the directory where the server is installed. 

•If the global manifest file indicates use of a local manifest file, the server attempts to read its local manifest file from the data directory. 

•Although global and local manifest files are located in different directories, the file name is mysqld.my  in both locations. 

•It is not an error for a manifest file not to exist. In this case, the server attempts no component loading associated with the file. 

Local manifest files permit setting up component loading for multiple instances of the server, such that loading instructions for each server instance are specific to a given data directory instance. This enables different MySQL instances to use different keyring components. 

Server manifest files have these properties: 

•A manifest file must be in valid JSON format. 

•A manifest file permits these items: 

• "read_local_manifest" : This item is permitted only in the global manifest file. If the item is not present, the server uses only the global manifest file. If the item is present, its value is true  or false , indicating whether the server should read component-loading information from the local manifest file. 

If the "read_local_manifest"  item is present in the global manifest file along with other items, the server checks the "read_local_manifest"  item value first: 

•If the value is false , the server processes the other items in the global manifest file and ignores the local manifest file. 

•If the value is true , the server ignores the other items in the global manifest file and attempts to read the local manifest file. 

• "components" : This item indicates which component to load. The item value is a string that specifies a valid component URN, such as "file://component_keyring_file" . A component URN begins with file://  and indicates the base name of the library file located in the MySQL plugin directory that implements the component. 

•Server access to a manifest file should be read only. For example, a mysqld.my  server manifest file may be owned by root  and be read/write to root , but should be read only to the account used to run 

