-
Type:
Task
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Server Security
-
Fully Compatible
-
Server Security 2026-01-16, Server Security 2026-01-30, Server Security 2026-02-13
-
None
-
None
-
None
-
None
-
None
-
None
-
None
When rotating to a new KEK, we need to dump the encrypted KEK object out to the oplog specifically for PIT restore, since PIT restore starts at a checkpoint and then uses the oplog to jog the system to a specific point-in-time. The oplog therefore needs to have the encrypted KEK to decrypt future oplog messages encrypted with the new KEK.
- causes
-
SERVER-119452 Ignore "km" oplog entries in change streams
-
- Closed
-
- is depended on by
-
TOOLS-4085 Investigate changes in SERVER-117223: Introduce a new SLS Oplog message for encrypted KEKs
-
- Accepted
-
-
-
- Closed
-