Arctera

Ability to delete stale keys of encrypted objects from KMS

December 18, 2025

Contributed by:

C C

So far, when volume encryption was secured by using a Key Management Server, Volume Manager copied the encryption key (KEK) of the volume and used it for the corresponding snapshot volumes.

Also, when Volume Manager deleted an encrypted object, it did not delete the associated KEK. Over time, many such unused keys would get accumulated on the KMS, which would probably incur costs.

To address these inefficiencies, Volume Manager has been enhanced as follows:

It uses separate KEKs for volumes and their snapshots.
When a volume or any of its snapshots is deleted, it also deletes the associated KEK from the KMS.
It provides a new tunable, delete_stale_kms_keys, which you can use to enable or disable the deletion of the associated KEK when an encrypted object is deleted. This feature is disabled by default.

Consideration for upgrade scenarios

You might have volumes and their snapshots created by earlier versions of Volume Manager in your environment, which share the same KEK. In such a scenario, if you enable the deletion of the associated KEK along with the encrypted object, the shared KEK will be deleted. Consequently, the other objects that shared the KEK will be rendered unusable, because Volume Manager will not be able to decrypt them.

For details, refer to the following documents as applicable to your environment:

Storage Foundation 9.0 Administrator’s Guide - Linux
Storage Foundation Cluster File System High Availability 9.0 Administrator’s Guide - Linux

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Ability to delete stale keys of encrypted objects from KMS

December 18, 2025

Contributed by:

C C

December 18, 2025

Contributed by:

C C

Ability to delete stale keys of encrypted objects from KMS

In this article