Purpose of rotate keys

[cstewart87]

I was trying to explain the knife vault rotate keys command the other day, and was having troubles fully understanding its purpose.

This command does not change who can access they vault, does it?

Is it for the case of client keys that have been regenerated on the chef server?

Thanks for any clarification.

[moserke]

Correct, it does not change any vault access, what it is for is rotating the symmetric key used for the underlying encrypted data bag item. You would do this for a couple reasons:

1. The symmetric key got compromised, so you rotate it to a new one
2. It's been awhile since key rotation and you have a policy that you have rotate keys on a certain time period

It randomly generates a new symmetric key and re-public encrypts it for each client/admin found in the vault.

Hope that helps!

Kevin