The MySQL Keyring Note kv/mysql/  in this example may need adjustment per your local installation policies and security requirements. If so, make the same adjustment wherever else  kv/mysql/  appears in these instructions. } Import the policy file to the Vault server to create a policy named  mysql-policy , then assign the policy to the new role: Obtain the ID of the newly created role and store it in a secure location: Generate a secret ID for the role and store it in a secure location: After these AppRole role ID and secret ID credentials are generated, they are expected to remain valid indefinitely. They need not be generated again and the  keyring_hashicorp  plugin can be configured with them for use on an ongoing basis. For more information about AuthRole authentication, visit https://www.vaultproject.io/docs/auth/approle.html. keyring_hashicorp Configuration vault write -f auth/approle/role/mysql/secret-id vault read auth/approle/role/mysql/role-id vault policy write mysql-policy mysql.hcl vault write auth/approle/role/mysql policies=mysql-policy The plugin library file contains the  keyring_hashicorp  plugin and a loadable function, keyring_hashicorp_update_config() . When the plugin initializes and terminates, it automatically loads and unloads the function. There is no need to load and unload the function manually. The  keyring_hashicorp  plugin supports the configuration parameters shown in the following table. To specify these parameters, assign values to the corresponding system variables. To be usable during the server startup process,  keyring_hashicorp  must be loaded using the  -- early-plugin-load  option. As indicated by the preceding table, several plugin-related system variables are mandatory and must also be set. For example, use these lines in the server  my.cnf  file, adjusting the .so  suffix and file locations for your platform as necessary: [mysqld] early-plugin-load=keyring_hashicorp.so keyring_hashicorp_role_id=’ee3b495c-d0c9-11e9-8881-8444c71c32aa’ keyring_hashicorp_secret_id=’0512af29-d0ca-11e9-95ee-0010e00dd718’ keyring_hashicorp_store_path=’/v1/kv/mysql’ keyring_hashicorp_auth_path=’/v1/auth/approle/login’ 1425 Configuration Parameter System Variable Mandatory HashiCorp Server URL keyring_hashicorp_server_url No AppRole role ID keyring_hashicorp_role_id Yes AppRole secret ID keyring_hashicorp_secret_id Yes Store path keyring_hashicorp_store_path Yes Authorization Path keyring_hashicorp_auth_path No CA certificate file path keyring_hashicorp_ca_path No Cache control keyring_hashicorp_caching No