[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-21 (世界標準時間)。"],[[["\u003cp\u003eApigee hybrid encrypts cache, contract, KMS, and KVM data by default without requiring any user configuration.\u003c/p\u003e\n"],["\u003cp\u003eDefault encryption keys are provided by Apigee hybrid, stored as Kubernetes Secrets, and utilize AES-128 standard encryption.\u003c/p\u003e\n"],["\u003cp\u003eUsers can replace default encryption keys with their own Base64-encoded keys during the initial Apigee hybrid installation.\u003c/p\u003e\n"],["\u003cp\u003eEach type of encryption key (contract, KMS, KVM, and cache) has a specific scope, either organization-wide or environment-specific, influencing where the key is used.\u003c/p\u003e\n"],["\u003cp\u003eChanging encryption keys after the runtime is established will render previously encrypted data unusable; only newly added data will be encrypted and work correctly, so key rotation is not supported.\u003c/p\u003e\n"]]],[],null,["# Data encryption\n\n| You are currently viewing version 1.12 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nBy default, the following data is stored *encrypted* in the hybrid\nruntime plane:\n\n- Cache data\n- Contract key data\n- Key management system (KMS) data\n- Key-value map (KVM) data\n\n\nData encryption does not require any special configuration on your part. However, if\nfor some reason you want to use your own encryption keys (replacing the default ones) you can\ndo so, as explained in this topic.\n\nEncryption key scope\n--------------------\n\n\nApigee hybrid encryption keys have scope. For example, KMS keys have *organization*\nscope. This means that the key is used to encrypt KMS data for the entire organization.\nThe following table lists the scope for\neach type of key:\n\nAbout the default encryption keys\n---------------------------------\n\n\nBy default, Apigee hybrid provides a set of Base64-encoded keys that are used to\nencrypt contract, KVM, KMS, and cache data. The Apigee hybrid installer stores the keys in the\nruntime plane as\n[Kubernetes\nSecrets](https://kubernetes.io/docs/concepts/configuration/secret/), and uses them to encrypt your data with AES-128 standard encryption.\nThe keys are under your control;\nthe hybrid management plane is never aware of them at any time.\n\n\nThe default keys are applied to all new Apigee hybrid components when you create them.\n| The default keys will work for most use cases. If you want to change the default encryption keys, do so when you initially install Apigee hybrid into a new cluster. If you change the encryption keys after the runtime is created in your cluster, previously encrypted data can no longer work (it cannot be decrypted); only new data added after the change will be encrypted and function as expected.\n\nChanging the default encryption keys\n------------------------------------\n\n\nAlthough not required, you can change any of the default encryption keys if you wish.\nTo replace one or more default keys, follow these steps:\n| If you change the encryption keys after the runtime is created in your cluster, previously encrypted data can no longer work (it cannot be decrypted); only new data added after the change will be encrypted and function as expected. For this reason, Apigee hybrid does not support key rotation for these keys.\n\n1. Copy the following stanzas into your overrides file. This configuration lets you change the KMS and KVM encryption keys for the organization level and the KVM and cache encryption keys for the environment level: \n\n ```actionscript-3\n defaults:\n org:\n kmsEncryptionKey: base64-encoded-key\n kvmEncryptionKey: base64-encoded-key\n contractEncryptionKey: base64-encoded-key\n\n env:\n kvmEncryptionKey: base64-encoded-key\n cacheEncryptionKey: base64-encoded-key\n ```\n2. Generate a new key for each key you wish to replace. Each key must be a Base64-encoded string that is exactly **16, 24, or 32 bytes long** . See also [How to create an encoded\n key](#how-to-create-an-encoded-key).\n3. Replace the default keys with new ones. In this example, all of the default keys are replaced with keys: \n\n ```actionscript-3\n defaults:\n org:\n kmsEncryptionKey: \"JVpTb1FwI0otUHo2RUdRN3pnVyQqVGlMSEFAJXYmb1c=\"\n kvmEncryptionKey: \"T3VkRGM1U3cpOFgtNk9fMnNZU2NaSVA3I1BtZWxkaUU=\"\n contractEncryptionKey: \"RDEyMzQ1Njc4OTAxMjM0NQ==\"\n env:\n kvmEncryptionKey: \"Q3h6M3R6OWdBeipxTURfKjQwQVdtTng2dU5mODFHcyE=\"\n cacheEncryptionKey: \"b2NTVXdKKjBzN0NORF9XSm9tWFlYKGJ6NUhpNystJVI=\"\n ```\n\nOverride the default keys\n-------------------------\n\nYou can override the keys for the org or specific envs named in your overrides file. When you create the components, keys you specify for the org or individual envs will be override the defaults.\n| If you change the encryption keys after the runtime is created in your cluster, previously encrypted data can no longer work (it cannot be decrypted); only new data added after the change will be encrypted and function as expected. For this reason, Apigee hybrid does not support key rotation for these keys.\n\n1. Copy the following stanzas into your overrides file. This configuration lets you change the KMS and KVM encryption keys for the organization level and the KVM and cache encryption keys for the environment level: \n\n ```actionscript-3\n org:YOUR_ORG_NAME\n\n kmsEncryptionKey: base64-encoded-key\n kvmEncryptionKey: base64-encoded-key\n contractEncryptionKey: base64-encoded-key\n\n envs\n - name: ENV_NAME\n kvmEncryptionKey: base64-encoded-key\n cacheEncryptionKey: base64-encoded-key\n\n - name: 2ND_ENV_NAME\n kvmEncryptionKey: base64-encoded-key\n cacheEncryptionKey: base64-encoded-key\n ```\n2. Generate a new key for each key you wish to override. Each key must be a Base64-encoded string that is exactly **16, 24, or 32 bytes long** . See also [How to create an encoded key](#how-to-create-an-encoded-key).\n3. Specify the keys you want to override. In this example, all of the default keys are replaced with keys: \n\n ```actionscript-3\n org:hybrid-org\n\n kmsEncryptionKey: \"QTEyMz1b2jc4OTAxMjM0NQ==\"\n kvmEncryptionKey: \"QzEyM2c3Njc4OTAxMjM0NQ==\"\n contractEncryptionKey: \"RDEyMzQ1Njc4OTAxMjM0NQ==\"\n\n envs:\n - name: prod\n kvmEncryptionKey: \"QzEyM2c3Njc4OTAxMjM0NQ==\"\n cacheEncryptionKey: \"QjEyAvC1Njc4OTAxMjM0NQ==\"\n\n envs:\n - name: test\n kvmEncryptionKey: \"A1b2C3d4E5f6G7h8I9j10K==\"\n cacheEncryptionKey: \"B1c2D3e4F5f6H7i8J9k10L==\"\n ```\n\nApply the key changes\n---------------------\n\nApply the overrides file to your cluster as with the following Helm commands:\n\n- If you change the contract key or the KVM key for the org, update the org: \n\n ```\n helm upgrade ORG_NAME apigee-org/ \\\n --namespace apigee \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ```\n- If you change Cache key or the KVM key for an environment, update the environment: \n\n ```\n helm upgrade ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --atomic \\\n --set env=ENV_NAME \\\n -f OVERRIDES_FILE.yaml\n ```\n- If you change KMS key, update both the org and environment: \n\n ```\n helm upgrade ORG_NAME apigee-org/ \\\n --namespace apigee \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ``` \n\n ```\n helm upgrade ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --set env=ENV_NAME \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ```\n\n| **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ENV_NAME*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\nA note about backward compatibility\n-----------------------------------\n\n\nIf you were to remove the encryption keys in your overrides file the first\ntime you install Apigee hybrid, you would\neffectively disable encryption and values would be stored unencrypted.\nIf at a later\ntime you enable encryption by providing keys,\nexiting data remains unencrypted; however, any future data that is added will\nbe encrypted. The system\nwill continue working normally with the unencrypted data and the new encrypted\ndata.\n\n\nAlso, note that\nyou cannot later change the encryption keys\nonce the runtime data is encrypted.\n\nHow to create an encoded key\n----------------------------\n\n\nA properly formatted Base-64-encoded key is required for KVM, KMS, and cache encryption.\nThe key used for any of these purposes must be Base-64 encoded from a string that is 16, 24, or\n32 bytes long, as explained below:\n| The key string length requirement exists because the [Advanced\n| Encryption Standard](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) (AES) cipher works on a block size of 128 bits, but can take three different key lengths: 128, 192, and 256 bits (16, 24, or 32 bytes).\n\n\nThe following example command generates a suitable, randomly generated, 32 character,\nBase64-encoded string: \n\n```\nhead -c 32 /dev/random | openssl base64\n```"]]
