Retire a rotated encryption key

After a key rotation, retire the previous encryption key when migration confirms that no persisted encrypted values depend on it. Retiring the old key reduces the number of keys that must be protected.

Before you begin

  • The EncryptionMigrationCompleted event is recorded and no persisted encrypted values reference the previous key.
  • You have cluster-admin permissions on the Red Hat OpenShift Container Platform cluster.
  • The oc CLI is installed and authenticated to the cluster.
  • Access to the Helm values.yaml file used for the Red Hat Edge Manager deployment.

About this task

Warning

Do not remove the old key before migration completes. If encrypted data still references the removed key, that data cannot be decrypted until the key is restored. If the old key material is lost, values encrypted with that key become permanently unreadable.

Procedure

  1. Update the values.yaml file to remove the old key entry from the keys list: 
    encryption:
  activeKeyID: "<key_name>"
  keys:
    - id: "<key_name>"
      path: "/root/.flightctl/encryption/<key_name>"
  2. Apply the updated Helm configuration and restart the deployments: 
    $ helm upgrade <release_name> deploy/helm/flightctl -n <project_name> -f values.yaml
     
    $ oc rollout restart -n <project_name> \
  deployment/flightctl-api \
  deployment/flightctl-worker \
  deployment/flightctl-periodic \
  deployment/flightctl-alert-exporter \
  deployment/flightctl-alertmanager-proxy \
  deployment/flightctl-remote-access \
  deployment/flightctl-imagebuilder-api \
  deployment/flightctl-imagebuilder-worker
  3. Remove the old key from the secret, where <old_key_file_name> is the file name of the key being retired, for example key for the initial default key: 
    $ oc patch secret flightctl-encryption-key -n <project_name> \
  --type json \
  --patch '[{"op": "remove", "path": "/data/<old_key_file_name>"}]'

Results

  • Verify that the secret contains only the active key: 
    $ oc get secret flightctl-encryption-key -n <project_name> -o jsonpath='{.data}' | python3 -m json.tool
  • Confirm that all services started successfully: 
    $ oc rollout status deployment/flightctl-api -n <project_name> --timeout=300s