COCKROACH-GEN-ENCRYPTION-KEY(1)

NAME

cockroach-gen-encryption-key - generate store key for encryption at rest

SYNOPSIS

cockroach gen encryption-key [flags]

DESCRIPTION

Generate store key for encryption at rest.

Generates a key suitable for use as a store key for Encryption At Rest. The resulting key file will be 32 bytes (random key ID) + key_size in bytes.

OPTIONS

-h, --help[=false]
    help for encryption-key

--overwrite[=false]
    Overwrite key if it exists

-s, --size=128
    AES key size for encryption at rest (one of: 128, 192, 256)

--version=1
    Encryption format version (1 or 2)

OPTIONS INHERITED FROM PARENT COMMANDS

--enterprise-require-fips-ready[=false]
    abort if FIPS readiness checks fail

--log=

Logging configuration, expressed using YAML syntax. For example, you can
 change the default logging directory with: --log='file-defaults: {dir: ...}'.
 See the documentation for more options and details. To preview how the log
 configuration is applied, or preview the default configuration, you can use
 the 'cockroach debug check-log-config' sub-command.

--log-config-file=

File name to read the logging configuration from. This has the same effect as
 passing the content of the file via the --log flag.

--log-config-vars=[]

Environment variables that will be expanded if present in the body of the
 logging configuration.

--log-dir=

--log-dir=XXX is an alias for --log='file-defaults: {dir: XXX}'.

--logtostderr[=UNKNOWN]

--logtostderr=XXX is an alias for --log='sinks: {stderr: {filter: XXX}}'. If
 no value is specified, the default value for the command is inferred: INFO for
 server commands, WARNING for client commands.

--redactable-logs=false

--redactable-logs=XXX is an alias for --log='file-defaults: {redactable:
 XXX}}'.

--vmodule=
    comma-separated list of pattern=N settings for file-filtered logging (significantly hurts performance)

SEE ALSO

cockroach-gen(1)

HISTORY

13-May-2026 Auto generated by spf13/cobra