Exporting the KEK

It is recommended to store the KEK offline outside of the cluster. The KEK is the key that encrypts all of the data encryption keys in the cluster as well as the data on the disks. It is therefore highly recommended to use the getClusterRootKey API to export the KEK and store it in a key vault or HSM.

In order to keep the KEK secure, you will be required to create a RSA4096 or RSA3072 private/public key pair and submit the public key in the API. The cluster will encrypt the KEK with the given public key and you can then decrypt it if needed with your private key.

Note that RSA-OAEP is used for better security and to validate the HASH of the script. If you need to decrypt the KEK, use RSA OAEP with your private key to decrypt it.

GenerationID is a parameter for KEK rotation. The API can only retrieve KEKs that are currently in the system (the current KEK and the previous generation KEK). By default, if the parameter is not used, you will get back the current KEK. If you want the previous KEK, you can specify the generation in this parameter.

To get the current encryption key generation, you can run the get clusterinfo API.

Input

encryptingKeyGeneration: Leave this empty if you only want the current encryption key.

userPublicKey: A user-generated public key.

Output

KeyObject

encryptedKey: The cluster KEK encrypted with the given public key.

encryptingKeyGenerationGenerationID: The generation of the KEK.

Exporting the KEK API

CLI

Get the current cluster root key (current KEK):

Or

REST