Rotating the Cluster Root Encryption Key

Your organizational security policies determine how often encryption keys should be rotated. Once a policy determines that keys should be rotated, you can invoke an API call that will cause the cluster to create a new KEK and re-encrypt the existing DEKs with the new KEK. The cluster always keeps a copy of the “old” KEK for one generation. During key rotation, there is a period of time (from seconds up to a few hours depending on the number of volumes/snapshots in the cluster) that the system re-encrypts the DEKs with the new KEK, and both KEKs are still valid (both the new one and the old one).

During key rotation, all of the existing data encryption keys are re-encrypted, so it is recommended not to run this API too frequently. There is a set cluster config parameter that defines a default of a 24-hour minimum interval between key rotations. So if you rotated the key successfully, you will only be able to rotate the key again 24 hours later.

To get the state of the rotation process, current encryption key generation, and the last date the key was rotated, you can run the get clusterinfo API.

KEK Rotation API

CLI

REST