# UCMDB-Server-Master-key-rotation_688996428
UD/UCMDB stores the master key for app-level encryption in the vault. This master key should be rotated as other keys used for storage encryption.

This section enables you to rotate the master key, by creating a script that changes the UCMDB master key with a newly generated one. The new master key can be either defined by you, or randomly generated by the script.

To rotate the master key, follow these steps:

1. On your local machine, create the **rotate\_masterkey. sh** file with the following content:
	```
	#!/bin/bash
	usage() {
	    echo "Usage: $0 -r <release> -n <namespace>"
	    exit 1
	}
	while getopts ":r:n:" opt; do
	    case $opt in
	        r) RELEASE=$OPTARG ;;
	        n) NAMESPACE=$OPTARG ;;
	        *) usage ;;
	    esac
	done
	if [ -z "$RELEASE" ] || [ -z "$NAMESPACE" ]; then
	    usage
	fi
	validate_password() {
	    local password="$1"
	    if [[ ! "$password" =~ [0-9] ]]; then
	        echo "Error: The new master key must contain at least one number."
	        return 1
	    fi
	    if [[ ! "$password" =~ [[:punct:]] ]]; then
	        echo "Error: The new master key must contain at least one punctuation character: +-./:[]_ "
	        return 1
	    fi
	    if [ ${#password} -ne 32 ]; then
	        echo "Error: The new master key must be exactly 32 characters long."
	        return 1
	    fi
	    return 0
	}
	while true; do
	    read -p "Enter the new master key (32 characters) or leave empty to generate one: " NEW_KEY
	    if [ -z "$NEW_KEY" ]; then
	        PUNCT_CHAR=$(</dev/urandom tr -dc '+-./:[]_' | tr -d ',[:alnum:]' | head -c 1)
	        ALPHA_NUM=$(< /dev/urandom tr -dc 'A-Za-z0-9' | head -c 31)
	        NEW_KEY=$(echo "$PUNCT_CHAR$ALPHA_NUM" | fold -w1 | shuf | tr -d '\n')
	        echo "No key provided. Generated a random 32-character key."
	        break
	    else
	        if validate_password "$NEW_KEY"; then
	            break
	        else
	            echo "Please try again."
	        fi
	    fi
	done
	ENCODED_KEY=$(echo -n "$NEW_KEY" | base64)
	echo "New Key: $NEW_KEY"
	HELM_VALUES=$(helm get values "$RELEASE" -n "$NAMESPACE" -o json)
	if [ $? -eq 0 ]; then
	    echo "$HELM_VALUES" > /tmp/values.tmp
	    echo "The Helm values file has been successfully saved"
	else
	    echo "Failed to get the Helm values."
	    exit 1
	fi
	jq '.acceptEula = true' /tmp/values.tmp > /tmp/values.old
	rm /tmp/values.tmp
	if jq . /tmp/values.old >/dev/null 2>&1; then
	    echo "The JSON in /tmp/values.old is valid."
	else
	    echo "The JSON in /tmp/values.old is invalid. Please check the Helm values output."
	    exit 1
	fi
	TEMP_FILE=$(mktemp)
	jq --arg new_key "$ENCODED_KEY" '.secrets["ucmdb_master_key"] = $new_key' /tmp/values.old > "$TEMP_FILE"
	if [ $? -eq 0 ]; then
	    echo "The ucmdb_master_key has been successfully replaced with the new encoded value."
	else
	    echo "Failed to update the ucmdb_master_key."
	    exit 1
	fi
	mv "$TEMP_FILE" /tmp/values.new
	echo "The updated Helm values file has been saved to /tmp/values.new"
	```
2. Run the following command to get the release name for the helm deployment, and the information about the UCMDB chart used in the deployment:
	```
	helm list -n <NAMESPACE>
	```
3. Run the following command to rotate the master key:
	```
	./rotate_masterkey.sh -r <RELEASE_NAME> -n <NAMESPACE>
	```
4. Enter the new master key, or press **Enter** if you want the script to generate a random one.
	The master key must contain exactly 32 characters and include at least one of each of the following four types of characters:
	- Uppercase alphabetic characters
		- Lowercase alphabetic characters
		- Numeric characters
		- Special characters: `:/._+-[]`
	The script returns two files:
	- **\\tmp\\values.old** - contains the information from the deployment with the old master key
		- **\\tmp\\values.new** - contains the information from the deployment with the new master key
5. Write down the value of the new master key, if you chose the key generated by the script.
6. Access JMX Console, and locate the **changeMasterKeyForCluster** method. Enter and confirm the new master key, and then select **Invoke**.
7. Run the following command to upgrade the helm deployment with the new master key value:
	```
	helm upgrade <RELEASE_NAME> <chart_file_location> --namespace <NAMESPACE> -f /tmp/values.new
	```
8. Run the following commands to restart the itom-ucmdb pods:
	```
	kubectl scale -n <NAMESPACE> --replicas=0 statefulset/itom-ucmdb
	```
	Wait for the itom-ucmdb pods to stop, and then run the following command:
	```
	kubectl scale -n <NAMESPACE> --replicas=2 statefulset/itom-ucmdb
	```
