Rotate the encryption key

Rotate the Red Hat Edge Manager encryption key to limit the exposure window if a key is compromised, or to satisfy periodic key-rotation policies required by your organization’s security standards.

Before you begin

  • A running Red Hat Edge Manager installation on Red Hat Enterprise Linux with root or sudo access.
  • openssl is installed on the host.
  • Access to the Red Hat Edge Manager service configuration file at /etc/flightctl/service-config.yaml.

About this task

Key rotation adds a new key alongside the existing key and marks the new key as active. After rotation, new data is encrypted with the active key. A background migration process re-encrypts existing data. The previous key remains configured for decryption until migration completes.

Procedure

  1. Generate a new 256-bit encryption key and save it to a file. Replace <key_name> with a descriptive identifier for the new key, such as a date: 
    $ (umask 077 && openssl rand -base64 32 > <key_name>)
  2. Back up the existing encryption key: 
    $ sudo cp /etc/flightctl/encryption/key /etc/flightctl/encryption/key.backup
  3. Verify that the backup file was created: 
    $ sudo ls -la /etc/flightctl/encryption/key.backup

    If the file does not exist, the backup failed. Do not continue until you have a valid backup.

  4. Place the new key file on the host: 
    $ sudo install -m 0600 <key_name> /etc/flightctl/encryption/<key_name>
  5. Update the encryption block in /etc/flightctl/service-config.yaml so that both keys are listed and the new key is active: 
    encryption:
  activeKeyID: "<key_name>"
  keys:
    - id: "default"
      path: "/root/.flightctl/encryption/key"
    - id: "<key_name>"
      path: "/root/.flightctl/encryption/<key_name>"

    The path values refer to the mount path inside the container, not the host filesystem path. The host directory /etc/flightctl/encryption/ is mounted into containers at /root/.flightctl/encryption/.

  6. Restart Red Hat Edge Manager services so that they load the new key configuration: 
    $ sudo systemctl restart flightctl.target
  7. Verify that all services started successfully: 
    $ sudo systemctl status flightctl.target

Results

  • Confirm that the encryption subsystem initialized with the new active key by checking the service logs: 
    $ sudo journalctl -u flightctl-api --no-pager -n 50 | grep -i "encryption"

    The log output should report the new key ID. For example:

    Encryption initialized: active=v1/<key_name>
  • Monitor migration progress to confirm that the background re-encryption completed. After rotation, Red Hat Edge Manager automatically re-encrypts existing protected data with the active key. No manual action is required.

    Red Hat Edge Manager records EncryptionMigrationStarted when migration begins and EncryptionMigrationCompleted when all protected records have been re-encrypted. These are Red Hat Edge Manager application events stored in the database, not system log messages. Query them by using the Flight Control API or CLI.

What to do next