[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-30 UTC。"],[],[],null,["# Rotate your cluster's security keys\n===================================\n\nKey Rotation\n------------\n\nKey rotation is the act of changing the\nunderlying cryptographic material contained in a *key encryption key (KEK)*. It\ncan be triggered\n\nmanually,\nusually after a security incident where keys might have been compromised. Key\nrotation replaces only the single field in the key that contains the raw\nencryption/decryption key data.\n\nTo rotate the customer-managed encryption keys, perform the following steps:\n\n1. [Create a new Azure Key Vault key version](https://docs.microsoft.com/en-us/azure/key-vault/keys/quick-create-cli).\n\n2. After a key rotation, new Secrets will be encrypted using the new key.\n Old Secrets will still be decrypted using old keys. The\n cluster stores key information along with the cipher to aid decryption\n after key rotation.\n\n Force the cluster to re-encrypt all secrets using the new key: \n\n kubectl get secrets --all-namespaces -o json | \\\n kubectl annotate --overwrite -f - encryption-key-rotation-time=`date +\"%Y%m%d-%H%M%S\"`"]]
