The Hashicorp Vault plugin currently supports key versioning provided by the Hashicorp Vault Server. However, there is no ways in the plugin to initiate a key rotation and reset the data stored in the cache. Because of this, it is really impossible to build scenarios in which key values change without restarting the server.
To address this shortcoming, we need to adds a new global variable that allows the user to initiate key rotation at the plugin level - similar to the key management plugin for AWS:
--[loose-]hashicorp-key-management-rotate-key=<identifier>|-1
|
Setting this variable to a certain value rotates corresponding key - all data associated with it is erased from the cache and will be re-requested from the Hashicorp Vault server the next time the system accesses this key. The user can also specify special value -1 (minus one) to rotate all keys. When specified value is zero, no key rotation is performed.
Task
Major
MDEV-29241 Hashicorp Plugin: Provide Key rotation
This looks like an overcomplication to me. It would be quite enough to be able to flush the whole cache, no need to do per per key. And to flush the whole cache one can simply set the cache_timeout to 0. Or may be, let's say, that setting cache_timeout to any value flushes the cache.
Or you can add an information_schema plugin to examine the cache, it'll show cached keys and versions (but not values, of course). Like, INFORMATION_SCHEMA.HASHICORP_KEY_MANAGEMENT_CACHE. And then it can support FLUSH command, like
FLUSH HASHICORP_KEY_MANAGEMENT_CACHE