Skip to main content
Version: 2026-11-04

Rotating keys

This guide lists the keys that protect an OpsChain installation and explains how to rotate each key that supports rotation.

K3s secrets encryption key​

When K3s is installed with --secrets-encryption true, as in the K3s installation guide, it encrypts Kubernetes Secrets with a key stored in /limepoint/k3s/server/cred/encryption-config.json.

Run these commands as root. K3s was installed with --data-dir /limepoint/k3s, so each command needs --data-dir /limepoint/k3s too.

Checking the status​

k3s secrets-encrypt status --data-dir /limepoint/k3s
Encryption Status: Enabled
Current Rotation Stage: start
Server Encryption Hashes: All hashes match

Active  Key Type  Name
------  --------  ----
 *      AES-CBC   aescbckey

Rotating the key​

k3s secrets-encrypt rotate-keys --data-dir /limepoint/k3s

Run the status command again until Current Rotation Stage shows reencrypt_finished. OpsChain keeps running while the Secrets are re-encrypted.

These steps apply to a K3s cluster with a single server node. For a cluster with several server nodes, follow the K3s documentation.

Backing up the K3s datastore

If you back up the K3s datastore, keep a copy of encryption-config.json with it, stored separately. Take a new copy after each rotation.

Enabling encryption on an existing server​

If K3s was installed without --secrets-encryption true, you can enable it on K3s v1.33.10+k3s1, v1.34.6+k3s1, v1.35.3+k3s1 or later. Each restart makes the Kubernetes API unavailable for a moment. Running pods keep running.

  1. Run k3s secrets-encrypt enable --data-dir /limepoint/k3s.
  2. Add secrets-encryption: true to /etc/rancher/k3s/config.yaml, then run systemctl restart k3s.
  3. Run k3s secrets-encrypt rotate-keys --data-dir /limepoint/k3s, then systemctl restart k3s again.
  4. Check that the status shows Encryption Status: Enabled and Current Rotation Stage: reencrypt_finished.

Backup encryption key​

To change the key that encrypts database backups, generate a new key pair and set the new public key in db.backup.encryption.publicKey on every cluster. New backups use the new key. Keep the old private key for as long as you keep backups encrypted with it.

OpsChain encryption keys​

The encryption keys in your values.yaml cannot be rotated yet. Keep them unchanged after installation.

Database password​

The database password (env.PGPASSWORD) cannot be changed after installation. Keep it unchanged.

Secret vault​

The secret vault seal key (secretVault.unsealKey) cannot be rotated yet. Keep it unchanged after installation.