Rotate the Vault encryption key

You can rotate your Vault Transit encryption key to generate a new key version while maintaining access to data encrypted with earlier versions.

Prerequisites
  • You have access to the cluster as a user with the cluster-admin role.

  • You have access to your Vault instance with permissions to rotate keys.

  • Kubernetes KMS v2 encryption is enabled and functioning.

Procedure
  1. Rotate the Vault encryption key by entering the following command:

    $ vault write -f transit/keys/kms-key/rotate

    Vault creates a new key version while maintaining earlier versions for decryption. The API server automatically uses the correct key version for each secret.

  2. Verify the new key version by entering the following command:

    $ vault read transit/keys/kms-key

    The latest_version field shows the current key version number.

Verification
  • Verify that existing secrets remain accessible by entering the following command:

    $ oc get secret -A

All secrets should be readable without errors.

Note

Existing encrypted secrets do not need re-encryption. Vault maintains all key versions and automatically uses the appropriate version for decryption.