Movatterモバイル変換

Keyring service consumers require that a keyring component or plugin be installed:

MySQL provides these keyring plugin choices:

To be usable by the server, the plugin library file must be located in the MySQL plugin directory (the directory named by theplugin_dir system variable). If necessary, configure the plugin directory location by setting the value ofplugin_dir at server startup.

A keyring component or plugin must be loaded early during the server startup sequence so that other components can access it as necessary during their own initialization. For example, theInnoDB storage engine uses the keyring for tablespace encryption, so a keyring component or plugin must be loaded and available prior toInnoDB initialization.

Installation for each keyring plugin is similar. The following instructions describe how to installkeyring_okv. To use a different keyring plugin, substitute its name forkeyring_okv.

Thekeyring_okv plugin library file base name iskeyring_okv. The file name suffix differs per platform (for example,.so for Unix and Unix-like systems,.dll for Windows).

To load the plugin, use the--early-plugin-load option to name the plugin library file that contains it. For example, on platforms where the plugin library file suffix is.so, use these lines in the servermy.cnf file, adjusting the.so suffix for your platform as necessary:

[mysqld]early-plugin-load=keyring_okv.so

Before starting the server, check the notes for your chosen keyring plugin for configuration instructions specific to that plugin:

After performing any plugin-specific configuration, start the server. Verify plugin installation by examining the Information SchemaPLUGINS table or use theSHOW PLUGINS statement (seeSection 7.6.2, “Obtaining Server Plugin Information”). For example:

mysql> SELECT PLUGIN_NAME, PLUGIN_STATUS       FROM INFORMATION_SCHEMA.PLUGINS       WHERE PLUGIN_NAME LIKE 'keyring%';+--------------+---------------+| PLUGIN_NAME  | PLUGIN_STATUS |+--------------+---------------+| keyring_okv  | ACTIVE        |+--------------+---------------+

If the plugin fails to initialize, check the server error log for diagnostic messages.

Plugins can be loaded by methods other than--early-plugin-load, such as the--plugin-load or--plugin-load-add option or theINSTALL PLUGIN statement. However, keyring plugins loaded using those methods may be available too late in the server startup sequence for certain components that use the keyring, such asInnoDB:

If no keyring component or plugin is available when a component tries to access the keyring service, the service cannot be used by that component. As a result, the component may fail to initialize or may initialize with limited functionality. For example, ifInnoDB finds that there are encrypted tablespaces when it initializes, it attempts to access the keyring. If the keyring is unavailable,InnoDB can access only unencrypted tablespaces. To ensure thatInnoDB can access encrypted tablespaces as well, use--early-plugin-load to load the keyring plugin.