Skip to content

Commit

Permalink
Docs: Update rotate encryption key command doc (#28888)
Browse files Browse the repository at this point in the history
- Add command examples from the tutorial

- Update for linting
  • Loading branch information
brianshumate authored Nov 12, 2024
1 parent 721a603 commit afdf42b
Showing 1 changed file with 30 additions and 6 deletions.
36 changes: 30 additions & 6 deletions website/content/docs/commands/operator/rotate.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,18 @@ description: |-

# operator rotate

The `operator rotate` rotates the underlying encryption key which is used to
secure data written to the storage backend. This installs a new key in the key
ring. This new key is used to encrypted new data, while older keys in the ring
are used to decrypt older data.
The `operator rotate` command rotates the underlying encryption key, which
secures data written to storage. This installs a new key in the key ring.
This new key encrypts new data, while older keys in the ring decrypt
older data.

This is an online operation and does not cause downtime. This command is run
This is an online operation and does not cause downtime. This command runs
per-cluster (not per-server), since Vault servers in HA mode share the same
storage backend.
storage.

As of **Vault 1.7**, Vault will automatically rotate the encryption key before
reaching 2<sup>32</sup> encryption operations, in adherence with NIST SP800-32D
guidelines.

## Examples

Expand All @@ -29,6 +33,26 @@ Key Term 3
Install Time 01 May 17 10:30 UTC
```

View the current automatic rotation policy:

```shell-session
$ vault read sys/rotate/config
```

Configure a time interval for automatic key rotation:

```shell-session
$ vault write sys/rotate/config interval=2160h
Success! Data written to: sys/rotate/config
```

Configure the maximum number of encryption operations per key:

```shell-session
$ vault write sys/rotate/config max_operations=123456789
Success! Data written to: sys/rotate/config
```

## Usage

The following flags are available in addition to the [standard set of
Expand Down

0 comments on commit afdf42b

Please sign in to comment.