<p>We are implementing encryption at rest in Kubernetes by this tutorial (<a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/</a>) and we are absolutely not sure why AES-GCM encryption provider requires to rotate the key every 200K writes, because of lack of knowledge about how encryption works. Also, what exactly means: &quot;200K writes&quot;, how can we define that we should rotate the key? Thank you</p>

<blockquote>
<p>we are absolutely not sure why AES-GCM encryption provider requires to rotate</p>
</blockquote>
<p>The GCM mode is basically a <a href="https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation" rel="nofollow noreferrer">CTR streaming mode</a> with built-in integrity validation (message authentication code). For this mode is very important to prevent reusing the same IV/key pair. It is advised to limit amount of the content encrypted with the same key limiting probability of the nonce-collision and options for key analysis (these is some math behind, already referred in the comments).</p>
<p>Yes, 200k is an arbitrary number, but someone has to state a reasonable number where nonce-collision probability is still negligible and the key is usable for significant time.</p>
<blockquote>
<p>what exactly means: &quot;200K writes&quot;,</p>
</blockquote>
<p>This is usually very hard to estimate, depending what is the &quot;write&quot;. It may be different if you use the key to encrypt other random keys (as a wrapping key) or the key is used to encrypt a lot of continuous content (e.g. a storage).</p>
<blockquote>
<p>how can we define that we should rotate the key?</p>
</blockquote>
<p>Let's be practical, e.g. AWS KMS provides automatic key rotation every year. Based on the question, assuming the key is used to encrypt the <em>etcd</em> storage (configuration), a yearly rotation can be a safe option. (I expect you don't have 200k  secrets and config maps in the k8s cluster).</p>
<p>The key rotation process usually creates a new key (key version) and new content is encrypted using a new key. The existing content is still possible to decrypt using the older keys.</p>
<p>In this regard I have a little concern about how the <a href="https://docs.openshift.com/container-platform/3.11/admin_guide/encrypting_data.html#encrypting-data-rotation" rel="nofollow noreferrer">key rotation</a> is described in the documentation. Basically the steps 1-4 look ok, a new encryption key is defined and put in force. The step 5 and 6 are to re-encrypt all the <em>etcd</em> content using the new key basically limiting (if not defying) the whole purpose of the key rotation. Maybe you could pick that up with the support if you have time and patience to dig in.</p>
