Deploy Encryption Keys with Reis (Flag Mode)

Create and manage encryption keys with Reis flag-mode commands: create from a key file, rotate, list versions, roll back, and attach to Bahriya projects.

Updated 18 Sept 20261 min read

Create and manage encryption keys directly from the command line using Reis flag-mode commands.

Create an encryption key

reis encryption_key:create \
  --name "Data Encryption Key" \
  --handle data-enc-key \
  --key_file ./keys/data.key.b64 \
  --format base64

The key file contains the raw key material (base64 or hex encoded). The handle must be DNS-1123 compliant (lowercase alphanumeric and hyphens, max 63 characters).

List encryption keys

reis encryption_key:list

Shows a table with handle, name, key size, format, and creation date for each key.

Show details

reis encryption_key:show <key-id>

Displays metadata including key size and format. The raw key is never displayed.

Rotate key material

reis encryption_key:rotate <key-id> \
  --key_file ./keys/new-data.key.b64

Creates a new version and marks it current. The previous version is retained for rollback. The format remains unchanged.

List versions

reis encryption_key:versions <key-id>

Activate a previous version (rollback)

reis encryption_key:activate_version <key-id> <version-number>

Delete an encryption key

reis encryption_key:delete <key-id>

Add --force to skip the confirmation prompt. Deleting removes all versions, project attachments, and container wiring.

Attach to a project

reis project:attach <project-id> encryption_keys data-enc-key

Singular alias encryption_key is also accepted. The project-id is the UUID Reis returns from project:list or project:show.

Detach from a project

reis project:detach <project-id> encryption_keys data-enc-key

If a running container still mounts the key, detach is rejected with a 409 naming the blocking container — tear it down (or remove its encryption_keys block) and retry.