How to rotate KEK in cloudberry cluster？

[wsg314]

I have a cloudberry cluster including 1 master and 2 segments. And I enable TDE function.
I want to alter KEK in all cluster node. What do I need to do?

[kongfanshen-0801]

Do you want to alter Master key or DEK (Data Encryption Key)?
We don't support rotate key.

Now we don't support alter Master key and DEK (Data Encryption Key) if the cluster is running.
And master key is hard code . If you want to change it, need to rebuild it.
The master key define in source code.
src/include/common/kmgr_utils.h
The relative code :

/*generate by cmd "echo cloudberry | sha256sum | cut -d' ' -f1 " */
#define DEFAULT_CLUSTER_KEY_COMMAND "echo 6f1c78b6722ae3f3b65e038a30f087d22e2a47f84578d5913e06ef5c871ae4c6"

[wsg314]

Cluster file encryption uses two levels of encryption — an upper key which encrypts lower-level keys. The upper-level key is often referred to as a Key Encryption Key (KEK). This key is not stored in the file system, but provided at initdb time and each time the server is started. This key can be easily changed via pg_alterckey without requiring any changes to the the data files or WAL files. from datebase-encryption.sgml

Can we support to rorate KEK by using pg_alterckey ?
I have read the code of pg_alterckey, it can only change KEK in one node（master or segment）.
Is there any way to change KEK in whole cluster ?

[kongfanshen-0801]

Initially, we designed to use pg_alterckey for rotating the key. However, rotating the KEK using pg_alterckey is an unfinished feature, and we haven't do any tests on it. It probably won't work.

[wsg314]

ok, i understand. thank you