Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Merotasi kunci keamanan cluster Anda
Rotasi Kunci
Rotasi kunci adalah tindakan mengubah materi kriptografis pokok yang terdapat dalam kunci enkripsi kunci (KEK). Fitur ini dapat dipicu secara manual, biasanya setelah terjadi insiden keamanan yang menyebabkan kunci mungkin telah disusupi. Rotasi
kunci hanya mengganti satu kolom dalam kunci yang berisi data kunci
enkripsi/dekripsi mentah.
Untuk mengganti kunci enkripsi yang dikelola pelanggan, lakukan langkah-langkah berikut:
Setelah rotasi kunci, Secret baru akan dienkripsi menggunakan kunci baru.
Secret lama akan tetap didekripsi menggunakan kunci lama. Cluster
menyimpan informasi kunci beserta sandi untuk membantu dekripsi
setelah rotasi kunci.
Paksa cluster untuk mengenkripsi ulang semua secret menggunakan kunci baru:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-31 UTC."],[],[],null,["# Rotate your cluster's security keys\n===================================\n\nKey Rotation\n------------\n\nKey rotation is the act of changing the\nunderlying cryptographic material contained in a *key encryption key (KEK)*. It\ncan be triggered\n\nmanually,\nusually after a security incident where keys might have been compromised. Key\nrotation replaces only the single field in the key that contains the raw\nencryption/decryption key data.\n\nTo rotate the customer-managed encryption keys, perform the following steps:\n\n1. [Create a new Azure Key Vault key version](https://docs.microsoft.com/en-us/azure/key-vault/keys/quick-create-cli).\n\n2. After a key rotation, new Secrets will be encrypted using the new key.\n Old Secrets will still be decrypted using old keys. The\n cluster stores key information along with the cipher to aid decryption\n after key rotation.\n\n Force the cluster to re-encrypt all secrets using the new key: \n\n kubectl get secrets --all-namespaces -o json | \\\n kubectl annotate --overwrite -f - encryption-key-rotation-time=`date +\"%Y%m%d-%H%M%S\"`"]]
