Retire a rotated encryption key

After a key rotation, retire the previous encryption key when migration confirms that no persisted encrypted values depend on it. Retiring the old key reduces the number of keys that must be protected.

Before you begin

  • The EncryptionMigrationCompleted event is recorded and no persisted encrypted values reference the previous key.
  • A running Red Hat Edge Manager installation on Red Hat Enterprise Linux with root or sudo access.

About this task

Warning

Do not remove the old key before migration completes. If encrypted data still references the removed key, that data cannot be decrypted until the key is restored. If the old key material is lost, values encrypted with that key become permanently unreadable.

Procedure

  1. Update /etc/flightctl/service-config.yaml to remove the old key entry from the keys list: 
    encryption:
  activeKeyID: "<key_name>"
  keys:
    - id: "<key_name>"
      path: "/root/.flightctl/encryption/<key_name>"
  2. Restart Red Hat Edge Manager services: 
    $ sudo systemctl restart flightctl.target
  3. Remove the old key file from the host, where <old_key_file_name> is the file name of the key being retired: 
    $ sudo rm /etc/flightctl/encryption/<old_key_file_name>

Results

  • Verify that all services started successfully: 
    $ sudo systemctl status flightctl.target