---
title: "Te hurihuri i ngā kī matua me ngā kī tā, me te wātea ohotata"
description: "Hurihia te kī matua e ārahi ana i ngā tohu whakamanatanga kua kohia, ā, whakamahia te wātea ohotata."
image: "https://docs.quirelms.com/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.quirelms.com/mi/llms.txt
> Use this file to discover all available pages before exploring further.

# Te hurihuri i ngā kī matua me ngā kī tā, me te wātea ohotata

<span id="master-key-and-signing-key-rotation-and-break-glass-access"></span>

Ngā tautuhinga whakahaere i te 21-compliance.md wāhanga 14 e tonoa ana e tētahi
arotake ma tana ingoa. Ko tēnei whārangi te tukanga; ko ā rātou tuhinga ngā taonga
whakamārama.

## Ngā kī <!--quire:the-keys-->

Ka kāingia ia tohu whakamanatanga kua kohia hei tētahi kī whakawhiti raraunga hou
(DEK). Ka whakakapi te DEK e te kī matua (te KEK), ā, ka tā te tohunga o te kī
matua i tōna taha (`key_ref`, rānei te tohunga i roto i tētahi uara kua
whakakotahi). Ka hurihuri i te kī matua, ka whakakapihia anō ngā DEK. Kāore e
wehenga ia i tētahi tohu whakamanatanga rānei te tā anō i a ia.

| Tautuhinga | Tikanga |
| --- | --- |
| `QUIRE_MASTER_KEY` | Te kī matua o tēnei wā: 32 byte, base64. Ka whakakapihia ia kupu tūmataiti hou i raro i a ia |
| `QUIRE_MASTER_KEY_VERSION` | Te tohuāhua ōna. `v1` mēnā kāore e tautuhia. Whakanuia ia i ia wā huri koe i te kī |
| `QUIRE_MASTER_KEY_RETIRED` | Ngā kī o mua e taea ana te noho i raro i ē kua kohia kupu tūmataiti, pērēi i te `v1=<base64>,v0=<base64>`. Ka pānuitia anake, ehara i te tuhi |

Ka pānui te wāhanga ipurangi, te kai mahi me te whakahau `bun run kek:rotate` ē
tautuhinga e toru kotahi. Me ōrite ō rātou uara, mēnā kāore, ka kore tētahi o
rātou e tuwhera i te mea kua kāingia e tētahi atu.

Me te kore te `QUIRE_MASTER_KEY`, ka pupuri ia wāhanga pūnaha te kī e hanga ana
ia mai i te `QUIRE_SECRET_KEY`. Ka mahi tēnei, ka whakaatuhia ia e te whārangi
Hauora Pūnaha hei mea kua heke tana hauora, ā, ka noho tonu e taea ana te pānui i
muri i te wā tautuhia ana koe i tētahi kī matua, ko ia te āhua e nekehia ai te
tuatahi hurihuri i ngā mea katoa i waho i a ia. Ka āea e te tāngata e pānui ana
te taiao o te pū te wehenga i ia tohu whakamanatanga kua kohia, nō reira me tētahi
kī matua tō tētahi whakaturanga whakaputanga, e pupuria ana i tētahi kohinga kupu
tūmataiti, ehara i te tahi pupuniBackup me te pūtaka.

## Te hurihuri <!--quire:rotating-->

Ka whakaaturia te tau o te kī i te Papa whakahaere Pū, Haumarutanga, Kī matua, ā,
hei tētahi ōrongotau te `quire.secrets.master_key.age` (ngā rā). Ka tuhi te
whakarite rā `platform.key_age` (03:41 UTC) tētahi tuhipoka whakamaumahara ki te
hono arotake o te pū i te wā e tae te kī ki te 365 rā, ā, anō ia 30 rā tae noa ki
te wā hurihuri. Hurihuria i te wā whakamaumahara, ā, i ia wā ka pā te kī ki te
tūmatanui.

1. Hangaia te kī hou: `openssl rand -base64 32`.
2. Tautuhia te `QUIRE_MASTER_KEY` ki a ia, ā, te `QUIRE_MASTER_KEY_VERSION` ki te
   tohu nō muri (`v2`). Nekehia te kī tawhito ki te `QUIRE_MASTER_KEY_RETIRED` ma
   te `v1=<old base64>`. Pupuritia tētahi tārua o ērua i tētahi wāhi kē i tēnei
   pūrere.
3. Whakaturia te wāhanga ipurangi me te kai mahi me ngā tautuhinga hou. Ka
   whakakapihia ngā kupu tūmataiti hou i tēnei wā i raro i te
   `env:QUIRE_MASTER_KEY:v2`; ka noho tonu e tuwhera ana ngā tawhito ma te kī o
   mua.
4. Tonoa te hurihuri, me te take e noho ana i te ara arotake:
   - i te papa whakahaere: Haumarutanga, Kī matua, Hurihuria te kī matua; rānei
   - i tētahi papa kōrero me te tahi taiao: `bun run kek:rotate request --reason "Annual rotation, ticket SEC-114"`.
5. Ka whakakapi te kai mahi i tētahi wāhanga ia meneti (te whakarite
   `platform.key_rotation` o te kaiwhakarite), ā, ka tīmata te mahi anō i muri i
   te tīmata anō. Kia oti i te wā kotahi: `bun run kek:rotate run`. Aroturukia ia ma
   te `bun run kek:rotate status`.
6. I te wā ka whakaatuhia e te tuhinga kua oti te hurihuri me **te kore mea kua
   whakataunga me te kore kua rahua**, tangohia te kī o mua mai i te
   `QUIRE_MASTER_KEY_RETIRED`, ā, whakaturia anō. Tae noa ki tērā, pupuritia ia:
   tētahi uara kāore e taea te neke ka noho tonu whakakapia i raro i te kī
   tawhito.

### He aha e tātaritia ai te mahi <!--quire:what-the-job-walks-->

Ia kohinga e pupuri ana i tētahi DEK kua whakakapia: ē kei te `SEALED_STORES`
(`apps/worker/src/key-rotation.ts`). Ka tātaritia ngā kohinga pūtaka whakahaere
i te pūtaka whakahaere; ka tātaritia ngā kohinga rōpū i te kōtahi rōpū ā-wāhanga
i raro i te haumarutanga ā-rārangi, i te pūtaka e pupuri ana i te rōpū, nō reira
ka hurihurihia tētahi wāhanga e pūmau ana ki tētahi pūtaka motuhake i tērā
pūtaka. Ka rahua tētahi whakamātau inā ka tāpiritia e te kupunga tētahi pou kī kua
whakakapia kāore e kīia ana e te rārangi, ā, tētahi atu inā ka tohungia e te
arotake tohu tētahi pou kua kāingia kāore e kitea ana e te rārangi.

### Te tuhinga <!--quire:the-record-->

- `ops.key_rotation`: tētahi rārangi ia hurihuri, me tana take, ko wai i tono,
  tana tūmaurunga me ōna tau (kua whakakapia anō, kua tū kē, kāore kua
  whakataunga, kua rahua).
- `ops.key_rotation_progress`: tētahi rārangi ia kohinga me ia rohe i te wā kua
  tātaritia, me ngā tohunga kī kāore e taea te pānui me te tau o ngā uara e noho
  ana i raro i ia. Ka wehea e tētahi hurihuri kua tīmata anō ēnei.
- Te hono arotake o te pū: `platform/key_rotation_request` (me te take), tētahi
  `platform/key_rotation_store` ia kohinga me ōna tau, ā, te
  `platform/key_rotation_complete` rānei te `platform/key_rotation_fail`; te
  `platform/key_age_reminder` mō te whakamaumahara.
- Ngā ōrongotau: te `quire.secrets.master_key.age` me te
  `quire.secrets.rewrap.outstanding` (ngā uara kāore e taea te neke e te hurihuri
  o mua).

### I te wā kāore whakataunga ngā uara <!--quire:when-values-are-unresolved-->

He uara kāore kua whakataunga tētahi ka whakakapia i raro i tētahi tohunga kī
kāore e pupuria ana e tēnei whakaturanga, rānei kāore ia i te āhua e kīia ana e
tana. Ka kīia e te tuhinga whakapae te tohunga (hei tauira te
`env:QUIRE_MASTER_KEY:v0 (unreadable)`). Whakahokia tērā kī ki te
`QUIRE_MASTER_KEY_RETIRED`, ā, whakatematema anō tētahi atu hurihuri, rānei, mēnā
kua ngaro te kī tonu, kia tāpiritia e te kaiwhakahaere o te rōpū tonu te tohu
whakamanatanga: ka kāingia ia i muri i tēnei i raro i te kī o tēnei wā. Ka
whakaatuhia ngā hurihuri kua rahua ē hapa i te tuhinga: whakatikaina te take, ā,
tonoa anō.

## Ngā kī tā <!--quire:signing-keys-->

Kei waho o te kī matua: ka tā ia rōpū ō rātou tohu OpenID Connect me ō rātou
karere LTI me tō rātou ake kī RSA, e whakaputanga ana i te
`/.well-known/jwks.json`. Kāore e hiahiatia tētahi kaiwhakahaere i konei. Ka
whakaputanga te whakarite ia wākahora `platform.signing_keys` tētahi kī hou i mua
i te 7 rā i te mutunga o ngā 90 rā o te kī o tēnei wā, i te wiki i muri ka tīmata
te kī hou te tā anō, ā, ka noho te kī tawhito hei kī e wehea ana, ā, i te 90 rā i
muri i tērā ka mukua te kī tawhito, ā, ka wehea ia i te kōpui kī. He tuhipoka
`platform/signing_key_advance` ia mahi i te hono arotake o te pū.

Kia whakakapia te kī o tētahi rōpū i mua i te wā, hei tauira i muri i tētahi
whakatū i te tūmatanui:

- i te papa whakahaere: Haumarutanga, Kī matua, Whakaputia tētahi kī tā hou
  (hiahiatia te `platform/keys_manage`); rānei
- i tētahi papa kōrero me te taiao o te kai mahi: `bun run kek:rotate signing-keys rotate
  --tenant <slug or id> --reason "Key exposed, INC-3310"`. Ka tuhia te `bun run kek:rotate
  signing-keys status` ngā kī o ia rōpū ma te wāhanga.

Ka whakaputanga te kī hou i te wā kotahi, ā, ka tīmata te tā anō i muri i te 7
rā, i te wā wehea ai te kī o tēnei wā. He whakaaro tika te wiki: ka kohina ngā pā
whakamahi te kōpui kī, ā, ka rahua tētahi tukunga iti ia ratonga i te wā kotahi.
Ka noho te kī e wehea ana i te kōpui kī mō ē 90 rā atu, kia tautara tonu ē tohu
kua tā kē e ia; mēnā ka hiahiatia te whakakore i te whakawhirinaki i a ia i mua i
te wā, ko te mukunga i tōna rārangi tētahi huringa e mahia ana e te kaiwhakahaere
me ōna ake urunga pūtaka i raro i tētahi tuhinga huringa (ko te wātea ohotata
pānui-anake); ā, ka rahua te tautara i ē tohu kua tā ia. Ko te hurihuri whakatā
te `platform/signing_key_rotate` i te hono arotake, me te take. Ka hiahiatia e te
kai mahi ngā tautuhinga `QUIRE_MASTER_KEY` kotahi me te wāhanga ipurangi te
whakakapi i te kī hou; ka whakakapi te `bun run kek:rotate` mō te kī matua ngā kī tā
me ngā mea atu (`oauth_signing_key` kei te `SEALED_STORES`).

## Te wātea ohotata whakaputanga <!--quire:break-glass-production-access-->

Kāore e pupuri tētahi i te wātea tūturu ki te whakaputanga. I te wā kāore e taea
te tatari, ka tukua e tētahi kai pupuri tētahi tono wātea ohotata: Papa whakahaere
Pū, Haumarutanga, Wāhea ohotata.

- He rohe tētahi tono (tētahi rōpū, rānei te rārangi whakahaere o te pū), he take
  iti rawa 20 pātuhi e tohu ana i te ohere rānei te tāketu, me tētahi wā mai i te
  5 ki te 240 meneti. Ka mutu i tōna ake: ka tātaritia ia ki te tā i ia tuku.
- Ka taea te tuku ki te kai pupuri e tuku ana, rānei ki tētahi atu kai pupuri (te
  āhua e rua tāngata). Ko te tāngata tētahi anake e taea ana te whakamahi. Ka
  hiahiatia te tono te `platform/break_glass_issue`, ā, te whakamahi te
  `platform/break_glass_use`; ērua kai pupuri anake i te tūtohu.
- Ka mahia ngā kōrero ma te āhurei, ehara i te takiuru pūtaka: pānui-anake,
  tētahi ā-wāhanga, e ārahihia ana ki te rōpū rānei ki te rārangi whakahaere, me
  tētahi tono 5 hēkona me te iti rawa 500 rārangi. Ka whakaaturia ngā uara
  binara ma te rahinga.
- Ka tuhia e te hono arotake o te pū te tono (me te take), te whakakore, ia
  kōrero i mua i te mahi (`platform/break_glass_statement`, me ē kua āraihia me te
  hua `denied`) me ia hua (`platform/break_glass_result`). Ka pupuri te
  `ops.break_glass_statement` i ngā tohu tuhipoka arotake, nō reira ka honona te
  tuhinga tono ki ōna tuhipoka arotake.
- Kāore e āea te tuhi. Tētahi huringa kāore e taea te tatari mō tētahi
  whakaputanga ka whakamahia te urunga pūtaka ōna ake o te kaiwhakahaere i raro
  i tōna ake tuhinga huringa, i waho o tēnei produk, ā, me tohu te tuhinga i te
  tohunga ohere e whakamahia ana i konei.

He aha kāore e tuku i ngā tohu whakamanatanga pūtaka: ka roa ake te ora o te
takiuru PostgreSQL i te hono i tono i a ia, ka wehea te haumarutanga ā-rārangi e
whino ana te taupānga, ā, kāore e taea te tuhi ki te hono arotake o tēnei produk,
nō reira ka tātaritia ā rātou kōrero i te tataunga o te tāngata i tukua te
rārangi pūrongo o te tūmau anake. Ka mahi te āhurei i te ara arotake hei āhuatanga
o te urunga ehara i tētahi tikanga kōtahi i a ia.

Kia whakautu i tētahi tono arotake: tuhia ngā tono i tērā wā (Wāhea ohotata),
tuwheria te whakapapa o tētahi tono mō ā rātou kōrero me ngā tohu tuhipoka
arotake, ā, pānuitia ēnā tuhipoka i te hono arotake o te pū
(`bun run audit:verify --platform` e whakaatu ana, ko te hono tūturu).

Source: https://docs.quirelms.com/mi/ops/key-rotation/index.mdx