Rotating runtime CredHub encryption keys

Here are instructions for rotating CredHub encryption keys for VMware Tanzu Application Service for VMs (TAS for VMs). Encryption keys are values that CredHub uses to obscure stored secrets. When an operator marks an additional key as primary, CredHub can rotate in that additional key as the encryption key.

During this credential rotation process, the initial encryption key is used to access the hidden value, That value is then stored again by the additional encryption key.

Caution: If you remove an encryption key and click Apply Changes before the rotation completes, the deployment breaks. If this happens, you can no longer access data stored with the deleted key.

Rotate TAS for VMs encryption keys

To rotate TAS for VMs encryption keys:

1. Go to the Ops Manager Installation Dashboard.

2. Click the TAS for VMs tile.

3. Select CredHub.

4. In the Encryption Keys section, click Add.

5. For Name, enter the name of your new encryption key.

6. For Key, enter your new encryption key.

7. Select the Primary check box.

8. Click Save.

9. Go to Ops Manager Installation Dashboard.

10. Click Review Pending Changes, then Apply Changes.

Verify encryption key rotation

To verify that the rotation completes:

1. Click the TAS for VMs tile.

2. Select the Status tab.

3. Within the CredHub job, locate Index 0.

   

4. Within the Logs column, click the correlating download icon.

5. Select the Logs tab.

6. Click the corresponding link to the retrieve the downloaded log file.

7. Unzip the log file.

8. Unzip the larger of the two nested directories.

9. Ops Manager generates a compressed file for each CredHub VM that exists on your deployment. Unzip each of these compressed files.

10. Open the credhub directory.

11. Open the credhub.log file. If the credential rotation completed successfully, the CredHub log contains the following string: Successfully rotated NUMBER-OF-CREDENTIALS items

12. Remove the old encryption key.

13. Click the trashcan icon that corresponds to the old encryption key.

14. Click Save.

15. Go to the Ops Manager Installation Dashboard.

16. Click Review Pending Changes, then Apply Changes.