oz0 server secrets-key reseal-older
For: Operators and developers looking up a command.
Data subjects' keys and tenants' payload keys are sealed by the edges with the secrets key, which management does not hold. An edge that was there before the edges sealed every key re-seals the older ones (sealed with the master key) for a day from its first start, and then refuses every key no edge sealed.
A new edge, or one whose data directory was lost, refuses them from its start, whatever the database says, so that a key placed by someone with the database is never taken. Run this on an edge's machine, with its data directory, when the keys still need it: every edge lost its data directory, or the cluster's keys were sealed before it had edges apart from management.
The edge reads the request at its next start, removes it, and re-seals such keys until a round finds none left, for a day at most; meanwhile it opens keys sealed with the master key, which management holds too. Run it on one edge, and only while management is one you trust.
Usage
oz0 server secrets-key reseal-older [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--data-dir | string | ~/.local/share/orchestrator-zero | the edge's data directory, as given to oz0 server start |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.