Rotate the Vault encryption key
You can rotate your Vault Transit encryption key to generate a new key version while maintaining access to data encrypted with earlier versions.
-
You have access to the cluster as a user with the
cluster-adminrole. -
You have access to your Vault instance with permissions to rotate keys.
-
Kubernetes KMS v2 encryption is enabled and functioning.
-
Rotate the Vault encryption key by entering the following command:
$ vault write -f transit/keys/kms-key/rotateVault creates a new key version while maintaining earlier versions for decryption. The API server automatically uses the correct key version for each secret.
-
Verify the new key version by entering the following command:
$ vault read transit/keys/kms-keyThe
latest_versionfield shows the current key version number.
-
Verify that existing secrets remain accessible by entering the following command:
$ oc get secret -A
All secrets should be readable without errors.
|
|
Existing encrypted secrets do not need re-encryption. Vault maintains all key versions and automatically uses the appropriate version for decryption. |