Rotate the master key

Replace the key that encrypts every secret in the control plane, for example after someone with host access leaves.

Rotate

sudo 5050d rotate-master-key

The command generates a new key, re-encrypts every secret column in one transaction, writes the new recovery key to a 0600 file and prints its path, and takes a fresh snapshot.

Afterwards

1. Store the new recovery key and delete the file from the host.
2. Keep the old recovery key until the old snapshots expire (30 days in the bucket): they are still encrypted with it.
3. Rotate API tokens and bucket keys too if you suspect a leak; the master key protects data at rest, not credentials someone already copied.