Mit Sammlungen den Überblick behalten
Sie können Inhalte basierend auf Ihren Einstellungen speichern und kategorisieren.
Der Plattformadministrator kann KMS-Schlüssel (Key Management System) auf dem Management API-Server löschen.
Der PA kann die AEAD- und Signaturschlüssel im Projekt-Namespace löschen.
Eine vollständige Liste der KMS-Schlüssel finden Sie unter Unterstützte Schlüssel.
Hinweise
Führen Sie die folgenden Schritte aus, bevor Sie fortfahren:
Konfigurieren Sie kubectl für den Zugriff auf den Management API-Server. Folgen Sie der Anleitung unter kubeconfig-Datei abrufen, um die gdcloud-Befehlszeile zu verwenden.
Rufen Sie die Rolle „KMS-Administrator“ ab, um KMS-Schlüssel zu löschen. Bitten Sie Ihren Organisations-IAM-Administrator, Ihnen die Rolle „KMS-Administrator“ (kms-admin) in Ihrem Projekt-Namespace zuzuweisen.
Alle Schlüssel löschen
Verwenden Sie den folgenden Befehl, um alle Schlüssel in einem Projektnamespace zu löschen:
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-09-04 (UTC)."],[[["\u003cp\u003ePlatform Administrators (PAs) can delete Key Management System (KMS) keys, including AEAD and Signing keys, within a project namespace via the Management API server.\u003c/p\u003e\n"],["\u003cp\u003eDeleting keys is irreversible, so users are cautioned that once deleted, keys cannot be retrieved.\u003c/p\u003e\n"],["\u003cp\u003eBefore deleting keys, users must configure \u003ccode\u003ekubectl\u003c/code\u003e to access the Management API server and obtain the KMS Admin (\u003ccode\u003ekms-admin\u003c/code\u003e) role within their project namespace.\u003c/p\u003e\n"],["\u003cp\u003eTo delete keys, the \u003ccode\u003ekubectl delete\u003c/code\u003e command must be used with the correct \u003ccode\u003eMANAGEMENT_API_SERVER\u003c/code\u003e, \u003ccode\u003eKEY_PRIMITIVE\u003c/code\u003e, and \u003ccode\u003ePROJECT\u003c/code\u003e values.\u003c/p\u003e\n"],["\u003cp\u003eTo delete all keys of all types, the \u003ccode\u003ekubectl delete\u003c/code\u003e command needs to be executed for each key primitive type, such as \u003ccode\u003eaeadkey\u003c/code\u003e and \u003ccode\u003esigningkey\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Wipe out KMS keys\n\n| **Warning:** Deleting keys is a total and complete wipeout. You cannot retrieve your keys after performing the actions on this page.\n\nThe Platform Administrator (PA) can delete Key Management System (KMS) keys in\nthe Management API server.\n\nThe PA can delete the AEAD and Signing keys in the project namespace.\nSee [Supported keys](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/kms/kms) for the full\nlist of KMS keys.\n\nBefore you begin\n----------------\n\nBefore continuing, ensure you do the following:\n\n- Configure `kubectl` to access the Management API server. Follow the steps in\n [Get a kubeconfig file](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-auth#get-kubeconfig) to\n use the `gdcloud` command-line interface (CLI).\n\n- Get the KMS Admin role to delete KMS keys. Ask your Organization IAM\n Admin to grant you the KMS Admin (`kms-admin`) role in your project namespace.\n\nDelete all keys\n---------------\n\nTo delete all keys in a project namespace, use the following\ncommand: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e \\\n delete \u003cvar translate=\"no\"\u003eKEY_PRIMITIVE\u003c/var\u003e --namespace=\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e --all\n\nReplace the following variables:\n\n- \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER\u003c/var\u003e: the kubeconfig file of the Management API server. [Sign in and generate](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in) the kubeconfig file if you don't have one.\n- \u003cvar translate=\"no\"\u003eKEY_PRIMITIVE\u003c/var\u003e: the keys you want to delete. For example: `aeadkey` for the `AEAD` key.\n- \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e with the name of the project. For example: `kms-test1`.\n\n| **Note:** To delete keys of all primitive types, ensure to run the command for all possible key primitive types: aeadkey and signingkey."]]
