Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.9.1
-
Ubuntu 22.04
Using apt packages:
mariadb-server 1:10.9.1+maria~jammy
mariadb-plugin-hashicorp-key-management 1:10.9.1+maria~jammy
Vault v1.11.2
-
Not for Release Notes
Description
Hi,
during evaluation of the Hashicorp Plugin I noticed the problem, that after a rotation of the encryption key in vault (set version 2 of the secret) and a restart of mariadbd I got an request loop (dos) from the hashicorp plugin against vault.
Reproduce by:
- Install mariadb-server & mariadb-plugin-hashicorp-key-management 10.9.1
- Install hashicorp vault, init and unseal vault
- create secret engine & set a secret key and enable audit_log for debugging purpose:
vault secrets enable -path /mariadb -version=2 kvvault kv put /mariadb/1 data=$(openssl rand -hex 32)vault audit enable file file_path=/hashicorp/vault_audit.log - enable encryption by adding the following block to mariadb section in /etc/mysql/mariadb.conf.d/50-server.cnf:
[mariadb]plugin_load_add = hashicorp_key_managementhashicorp-key-management-vault-url=http://127.0.0.1:8200/v1/mariadbhashicorp-key-management-token=xxxxxxxxxxxxxxxxxinnodb_encrypt_tables = FORCEinnodb_encrypt_log = ONinnodb_encrypt_temporary_tables = ONencrypt_tmp_disk_tables = ONencrypt_tmp_files = ONencrypt_binlog = ONaria_encrypt_tables = ONinnodb_encryption_threads = 4innodb_encryption_rotation_iops = 2000log_error=server.log
- set new key version
vault kv put /mariadb/1 data=$(openssl rand -hex 32) - service mariadb restart
- check /hashicorp/vault_audit.log mariadbd sends an endless loop of requests to vault
Load of my 1vCPU Instance increases to 7 due to high cpu load of vault & mariadbd
Attachments
Issue Links
- is part of
-
MDEV-30849 Hashicorp Plugin: enable key version caching by default
-
- Closed
-