Enabling rekey for an encrypted Volume

Last published : Jun 12, 2026
You can encrypt the key of an already encrypted Volume as an additional security measure.
As prerequisites, you must configure KMS server and encrypt the Volume. To know how to enable Disk level encryption, See Installing InfoScale on Kubernetes.
Alternatively, to know how to set encryption to True for a Persistent Volume Claim (PVC) See Static provisioning.
Complete the following steps -
  1. Run kubectl annotate pvc <Name of the PVC> "infoscale.veritas.com/rekey-operation=run" --overwrite to request rekey on a Volume.
  2. Run kubectl describe pvc to verify whether the message and event is added to the PVC object.
Rekey Done in the output similar to the following indicates success.
Name:          <Name of the  PVC>
Namespace:     default
StorageClass:  vxvmsc-mirror
Status:        Bound
Volume:        pvc-0d250ea6-0667-4b2b-b82e-4d42873956a9
Labels:        <none>
Annotations:   infoscale.veritas.com/rekey-operation:
               Last rekey done at 2022-09-28 08:28:47.18607609+0000 UTC
               pv.kubernetes.io/bind-completed: yes
               pv.kubernetes.io/bound-by-controller: yes
               volume.beta.kubernetes.io/storage-provisioner:
                                   org.veritas.infoscaleFinalizers:    [kubernetes.io/pvc-protection]
Capacity:      10M
Access Modes:  RWX
VolumeMode:    Filesystem
Used By:       \<none\>
Events:
  Type    Reason                 Age  From
  Normal  ExternalProvisioning   39s (x3 over 39s)
                                     persistentvolume-controller
  Normal  Provisioning           39s org.veritas.infoscale_infoscale
        -csi-controller-21176-0_f1c43459-d527-4764-83f3-d9229eef9d35
  Normal  ProvisioningSucceeded  38s org.veritas.infoscale_infoscale
        -csi-controller-21176-0_f1c43459-d527-4764-83f3-d9229eef9d35
  Normal  Rekey Done             16s infoscalestorageMessage
-------
waiting for a volume to be created, either by external provisioner
     "org.veritas.infoscale" or manually created by system administrator
External provisioner is provisioning volume for claim
                                            "default/<Name of the PVC>"
Successfully provisioned volume pvc-0d250ea6-0667-4b2b-b82e-4d42873956a9
Last rekey done at 2022-09-28 08:28:47.18607609 +0000 UTC
Note: After Disaster Recovery (DR) configuration, if rekey is performed on a Volume; the parametervxvm.attr.encwvekis not replicated from the primary to the secondary cluster. Althoughvxvm.attr.encwvekis different on the secondary cluster, Disaster Recovery (DR) operation takes place successfully.