## A.17.14. How do I change (rotate, re-key) the master encryption key? 

InnoDB  data-at-rest encryption uses a two tier key mechanism. When data-at-rest encryption is used, individual tablespace keys are stored in the header of the underlying tablespace data file. Tablespace keys are encrypted using the master encryption key. The master encryption key is generated when tablespace encryption is enabled, and is stored outside the database. The master encryption key is rotated using the ALTER INSTANCE ROTATE INNODB MASTER KEY  statement, which generates a new master encryption key, stores the key, and rotates the key into use. 

## A.17.15. How do I migrate data from a cleartext InnoDB  tablespace to an encrypted InnoDB  tablespace? 

Transferring data from one tablespace to another is not required. To encrypt data in an InnoDB  file- per-table tablespace, run ALTER TABLE tbl_name  ENCRYPTION = ’Y’ . To encrypt a general tablespace or the mysql  tablespace, run ALTER TABLESPACE tablespace_name  ENCRYPTION = ’Y’ . Encryption support for general tablespaces was introduced in MySQL 8.0.13. Encryption support for the mysql  system tablespace is available as of MySQL 8.0.16. 

## A.18 MySQL 8.0 FAQ: Virtualization Support 

A.18.1 Is MySQL supported on virtualized environments such as Oracle VM, VMWare, Docker, Microsoft Hyper-V, or others? .............................................................................................. 5279 

A.18.1. Is MySQL supported on virtualized environments such as Oracle VM, VMWare, Docker, Microsoft Hyper-V, or others? 

MySQL is supported on virtualized environments, but is certified only for Oracle VM. Contact Oracle Support for more information. 

Be aware of potential problems when using virtualization software. The usual ones are related to performance, performance degradations, slowness, or unpredictability of disk, I/O, network, and memory. 

