Secret Rotator

This section describes how to rotate the secrets encrypted with a Tink keyset in Horizon and Stream

Installation

  • RHEL

  • Debian

  • Docker

Secret rotator requires java 17 or 21 installed

Installation from the EverTrust repository

Create a /etc/yum.repos.d/evertrust-secret-rotator.repo file containing the EverTrust repository info:

[evertrust-secret-rotator]
enabled=1
name=Secret-rotator Repository
baseurl=https://repo.evertrust.io/repository/evertrust-secret-rotator-rpm/
gpgcheck=1
gpgkey=https://evertrust.io/.well-known/rpm/gpg.pub
username=<username>
password=<password>

Replace <username> and <password> with the credentials you were provided.

Make sure the Evertrust GPG key is trusted:

# rpm --import https://evertrust.io/.well-known/rpm/gpg.pub

You can then run the following to install the latest Secret-rotator version:

# yum install evertrust-secret-rotator

To prevent unattended upgrades when running yum update, you should pin the Secret-rotator version by adding

exclude=evertrust-secret-rotator

at the end of the /etc/yum.repos.d/evertrust-secret-rotator.repo file after installing Secret-rotator.

Installing from RPM

Download the latest RPM for Secret-rotator on the Official EVERTRUST repository.

Upload the file evertrust-secret-rotator-<latest>.noarch.rpm to the server;

Access the server with an account with administrative privileges;

Install the Secret-rotator package with the following command:

# yum localinstall /root/evertrust-secret-rotator-<latest>.noarch.rpm

If you wish to verify the signature of the RPM package, the EVERTRUST key can be added to your trusted keys using the following command:

# rpm --import https://evertrust.io/.well-known/rpm/gpg.pub

The signature can then be verified using the following command:

# rpm -K /root/evertrust-secret-rotator-<latest>.noarch.rpm
Secret rotator requires java 17 or 21 installed

Installation from the EverTrust repository

If you haven’t already, to add the EVERTRUST repository to your APT repositories, run the following commands:

  1. Install the required tools (gpg)

    # sudo apt install gnupg

  2. Download and install the EVERTRUST GPG key

    # curl https://evertrust.io/.well-known/apt/gpg.pub | sudo gpg -o /usr/share/keyrings/evertrust.gpg --dearmor

  3. Add the repository

    # echo "deb [ arch=all,amd64 signed-by=/usr/share/keyrings/evertrust.gpg ] https://repo.evertrust.io/repository/apt all main" | sudo tee /etc/apt/sources.list.d/evertrust.list

Once the repository has been added, authentication to it must be provided. To do so, edit the /etc/apt/auth.conf file and add the following lines:

machine repo.evertrust.io
login <your EVERTRUST login>
password <your EVERTRUST password>

Once the repository has been added, run the following command to update the APT repository list.

# sudo apt update

You can then run the following command to install the latest Secret-rotator version:

# sudo apt install evertrust-secret-rotator

To prevent unattended upgrades when running apt upgrade, you should pin the Secret-rotator version by creating a /etc/apt/preferences.d/evertrust-secret-rotator file:

Package: evertrust-secret-rotator
Pin: version 
Pin-Priority: 1001

Installing from DEB

Download the latest DEB for Secret-rotator on the Official EVERTRUST repository.

Upload the file evertrust-secret-rotator_<latest>_all.deb to the server;

Access the server with an account with administrative privileges;

Install the Secret-rotator package with the following command:

# apt install /root/evertrust-secret-rotator_<latest>_all.deb

The Secret rotator utility is available at:

registry.evertrust.io/evertrust-secret-rotator