Move every data key onto the current master key

Changed on

Rewrap the data key of every encrypted object version and in-flight upload under the current master key (encryption.master_key_file). Only the keys are rewritten, never object data. Safe to interrupt and run again: keys already current are skipped. A previous master key can be removed from encryption.previous_key_files once a run reports remaining 0. In a cluster, every node must already have the new key as current and the old one as previous; one run covers the cluster. Returns 501 when no master key is configured.

post/api/v1/encryption/rotate

Request

  • Base URL: http://localhost:8090
  • URL: http://localhost:8090/api/v1/encryption/rotate
  • Auth: none declared

Response

What the rotation did.

rewrappedinteger required

Data keys moved onto the current master key by this run.

currentinteger required

Data keys already under the current master key.

remaininginteger required

Data keys that could not be moved; the old master key must stay while this is not 0.

failedstring[] required

Up to 100 of the versions not moved, as bucket/key@version: reason.

Changes