---
title: CouchbaseEncryptionKey Resource
pubDate: 2026-08-17T09:53:44.266Z
antora:
  editUrl: https://github.com/couchbase/couchbase-operator/edit/2.9.x/docs/user/modules/ROOT/pages/resource/couchbaseencryptionkey.adoc
  xref: xref:operator::resource/couchbaseencryptionkey.adoc[]
---

[Consult the llms.txt file for a full list of contents](/llms.txt)
[View original HTML](/operator/current/resource/couchbaseencryptionkey.html)

# CouchbaseEncryptionKey Resource

The CouchbaseEncryptionKey resource is used to manage encryption keys for a Couchbase cluster. CouchbaseEncryptionKey is the Schema for the couchbaseencryptionkeys API.

The following is an example resource, depicting the overall structure and any defaults (consult the field reference for valid values for "empty" values, such as empty strings etc.):

```yaml
apiVersion: v2
kind: CouchbaseEncryptionKey
metadata:
  name: ""
spec:
  autoGenerated:
    canBeCached: True
    encryptWithKey: ""
    rotation:
      intervalDays: 0
      startTime: ""
  awsKey:
    credentialsSecret: ""
    keyARN: ""
    keyRegion: ""
    profileName: ""
    useIMDS: false
  keyType: ""
  kmipKey:
    clientSecret: ""
    encryptionApproach: ""
    host: ""
    keyID: ""
    port: 0
    timeoutInMs: 0
    verifyWithCouchbaseCA: True
    verifyWithSystemCA: True
  usage:
    allBuckets: True
    audit: True
    configuration: True
    key: True
    log: True
```

## [](#couchbaseencryptionkeys-apiversion)couchbaseencryptionkeys.apiVersion

### [](#constraints)Constraints

**Type**: `string`

### [](#description)Description

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources>.

## [](#couchbaseencryptionkeys-kind)couchbaseencryptionkeys.kind

### [](#constraints-2)Constraints

**Type**: `string`

### [](#description-2)Description

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds>.

## [](#couchbaseencryptionkeys-metadata)couchbaseencryptionkeys.metadata

### [](#constraints-3)Constraints

**Required**

**Type**: `object`

### [](#description-3)Description

Standard object metadata as defined for all Kubernetes types.

For additional details see the [Kubernetes reference documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/).

### [](#couchbaseencryptionkeys-metadata-name)couchbaseencryptionkeys.metadata.name

#### [](#constraints-4)Constraints

**Type**: `string`

#### [](#description-4)Description

The name of a resource. This must be unique for the kind of resource within the namespace.

All resources must have a name. The name may be omitted and `metadata.generateName` used instead to generate a unique resource name.

For additional details on resource names, see the [Kubernetes reference documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/).

### [](#couchbaseencryptionkeys-metadata-namespace)couchbaseencryptionkeys.metadata.namespace

#### [](#constraints-5)Constraints

**Type**: `string`

#### [](#description-5)Description

The namespace the resource resides in. All resources reside in a namespace.

The namespace is optional and may be specified in YAML configuration to override the namespace supplied by `kubectl`.

For additional details on namespaces, see the [Kubernetes reference documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).

### [](#couchbaseencryptionkeys-metadata-labels)couchbaseencryptionkeys.metadata.labels

#### [](#constraints-6)Constraints

**Type**: `map[string]string`

#### [](#description-6)Description

Labels allow resources to be labeled with key/value pairs of data. Labels are indexed and allow resources to be selected based upon specified labels.

Labels are relevant for certain types when using [label selection](../concept-label-selection.md) within your resources.

For additional details on labels and selectors, see the [Kubernetes reference documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/).

### [](#couchbaseencryptionkeys-metadata-annotations)couchbaseencryptionkeys.metadata.annotations

#### [](#constraints-7)Constraints

**Type**: `map[string]string`

#### [](#description-7)Description

Annotations allow resources to be annotated with key/value pairs of data. Annotations are arbitrary, and not indexed, so cannot be used to select resources, however may be used to add context or accounting to your resources.

For additional details on annotations, see the [Kubernetes reference documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/).

## [](#couchbaseencryptionkeys-spec)couchbaseencryptionkeys.spec

### [](#constraints-8)Constraints

**Type**: `object`

### [](#description-8)Description

CouchbaseEncryptionKeySpec defines the desired state of CouchbaseEncryptionKey.

### [](#couchbaseencryptionkeys-spec-autogenerated)couchbaseencryptionkeys.spec.autoGenerated

#### [](#constraints-9)Constraints

**Type**: `object`

#### [](#description-9)Description

AutoGenerated defines settings for auto-generated keys. This field is only valid when KeyType is "AutoGenerated".

### [](#couchbaseencryptionkeys-spec-autogenerated-canbecached)couchbaseencryptionkeys.spec.autoGenerated.canBeCached

#### [](#constraints-10)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-10)Description

CanBeCached defines whether the key can be cached.

### [](#couchbaseencryptionkeys-spec-autogenerated-encryptwithkey)couchbaseencryptionkeys.spec.autoGenerated.encryptWithKey

#### [](#constraints-11)Constraints

**Type**: `string`

#### [](#description-11)Description

EncryptWithKey is the name of another encryption key to use to encrypt the auto-generated key. If not provided, the key will be encrypted with the master password.

### [](#couchbaseencryptionkeys-spec-autogenerated-rotation)couchbaseencryptionkeys.spec.autoGenerated.rotation

#### [](#constraints-12)Constraints

**Type**: `object`

#### [](#description-12)Description

Rotation defines the rotation settings for the auto-generated key. If not provided, the key will not be rotated.

### [](#couchbaseencryptionkeys-spec-autogenerated-rotation-intervaldays)couchbaseencryptionkeys.spec.autoGenerated.rotation.intervalDays

#### [](#constraints-13)Constraints

**Required**

**Type**: `integer`

**Minimum**: `1`

#### [](#description-13)Description

IntervalDays defines the rotation interval in days.

### [](#couchbaseencryptionkeys-spec-autogenerated-rotation-starttime)couchbaseencryptionkeys.spec.autoGenerated.rotation.startTime

#### [](#constraints-14)Constraints

**Type**: `string`

#### [](#description-14)Description

StartTime defines when rotation should start (timestamp).

### [](#couchbaseencryptionkeys-spec-awskey)couchbaseencryptionkeys.spec.awsKey

#### [](#constraints-15)Constraints

**Type**: `object`

#### [](#description-15)Description

AwsKey defines settings for AWS KMS keys. This field is only valid when KeyType is "AWS".

### [](#couchbaseencryptionkeys-spec-awskey-credentialssecret)couchbaseencryptionkeys.spec.awsKey.credentialsSecret

#### [](#constraints-16)Constraints

**Type**: `string`

#### [](#description-16)Description

CredentialSecret is the name of the secret containing AWS credentials. The secret must contain a key with the name "credentials" with the data value of the AWS credentials file.

### [](#couchbaseencryptionkeys-spec-awskey-keyarn)couchbaseencryptionkeys.spec.awsKey.keyARN

#### [](#constraints-17)Constraints

**Required**

**Type**: `string`

#### [](#description-17)Description

KeyArn is the ARN of the AWS KMS key.

### [](#couchbaseencryptionkeys-spec-awskey-keyregion)couchbaseencryptionkeys.spec.awsKey.keyRegion

#### [](#constraints-18)Constraints

**Type**: `string`

#### [](#description-18)Description

KeyRegion is the AWS region where the key is located.

### [](#couchbaseencryptionkeys-spec-awskey-profilename)couchbaseencryptionkeys.spec.awsKey.profileName

#### [](#constraints-19)Constraints

**Type**: `string`

#### [](#description-19)Description

ProfileName is the name of the profile to use from the credentials secret.

### [](#couchbaseencryptionkeys-spec-awskey-useimds)couchbaseencryptionkeys.spec.awsKey.useIMDS

#### [](#constraints-20)Constraints

**Type**: `boolean`

#### [](#description-20)Description

UseImds defines whether to use IMDS for authentication.

### [](#couchbaseencryptionkeys-spec-keytype)couchbaseencryptionkeys.spec.keyType

#### [](#constraints-21)Constraints

**Required**

**Type**: `string`

**Enumerations**: `AutoGenerated, AWS, KMIP`

#### [](#description-21)Description

KeyType defines the type of encryption key. This field is immutable after creation.

### [](#couchbaseencryptionkeys-spec-kmipkey)couchbaseencryptionkeys.spec.kmipKey

#### [](#constraints-22)Constraints

**Type**: `object`

#### [](#description-22)Description

KmipKey defines settings for KMIP keys. This field is only valid when KeyType is "KMIP".

### [](#couchbaseencryptionkeys-spec-kmipkey-clientsecret)couchbaseencryptionkeys.spec.kmipKey.clientSecret

#### [](#constraints-23)Constraints

**Required**

**Type**: `string`

#### [](#description-23)Description

ClientSecret is the name of the secret containing the client private key, cert and passphrase. The secret must contain the keys "tls.crt", "tls.key", and "passphrase" with the data value of the client cert, key in encrypted pkcs8 format, and the passphrase for the key respectively.

### [](#couchbaseencryptionkeys-spec-kmipkey-encryptionapproach)couchbaseencryptionkeys.spec.kmipKey.encryptionApproach

#### [](#constraints-24)Constraints

**Type**: `string`

**Enumerations**: `NativeEncryptDecrypt, LocalEncrypt`

#### [](#description-24)Description

EncryptionApproach defines the encryption approach to use.

### [](#couchbaseencryptionkeys-spec-kmipkey-host)couchbaseencryptionkeys.spec.kmipKey.host

#### [](#constraints-25)Constraints

**Required**

**Type**: `string`

#### [](#description-25)Description

Host is the KMIP server host.

### [](#couchbaseencryptionkeys-spec-kmipkey-keyid)couchbaseencryptionkeys.spec.kmipKey.keyID

#### [](#constraints-26)Constraints

**Type**: `string`

#### [](#description-26)Description

KeyID is the KMIP key identifier.

### [](#couchbaseencryptionkeys-spec-kmipkey-port)couchbaseencryptionkeys.spec.kmipKey.port

#### [](#constraints-27)Constraints

**Required**

**Type**: `integer`

**Minimum**: `1`

**Maximum**: `65536`

#### [](#description-27)Description

Port is the KMIP server port.

### [](#couchbaseencryptionkeys-spec-kmipkey-timeoutinms)couchbaseencryptionkeys.spec.kmipKey.timeoutInMs

#### [](#constraints-28)Constraints

**Required**

**Type**: `integer`

**Minimum**: `1000`

**Maximum**: `300000`

#### [](#description-28)Description

TimeoutInMs is the timeout in milliseconds.

### [](#couchbaseencryptionkeys-spec-kmipkey-verifywithcouchbaseca)couchbaseencryptionkeys.spec.kmipKey.verifyWithCouchbaseCA

#### [](#constraints-29)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-29)Description

VerifyWithCouchbaseCA defines whether to verify with Couchbase CA.

### [](#couchbaseencryptionkeys-spec-kmipkey-verifywithsystemca)couchbaseencryptionkeys.spec.kmipKey.verifyWithSystemCA

#### [](#constraints-30)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-30)Description

VerifyWithSystemCA defines whether to verify with system CA.

### [](#couchbaseencryptionkeys-spec-usage)couchbaseencryptionkeys.spec.usage

#### [](#constraints-31)Constraints

**Required**

**Type**: `object`

**Default**: `{'allBuckets': True, 'audit': True, 'configuration': True, 'key': True, 'log': True}`

#### [](#description-31)Description

Usage defines what the encryption key should be used for.

### [](#couchbaseencryptionkeys-spec-usage-allbuckets)couchbaseencryptionkeys.spec.usage.allBuckets

#### [](#constraints-32)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-32)Description

AllBuckets defines whether the key should be used for all buckets.

### [](#couchbaseencryptionkeys-spec-usage-audit)couchbaseencryptionkeys.spec.usage.audit

#### [](#constraints-33)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-33)Description

Audit defines whether the key should be used for audit.

### [](#couchbaseencryptionkeys-spec-usage-configuration)couchbaseencryptionkeys.spec.usage.configuration

#### [](#constraints-34)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-34)Description

Configuration defines whether the key should be used for configurations.

### [](#couchbaseencryptionkeys-spec-usage-key)couchbaseencryptionkeys.spec.usage.key

#### [](#constraints-35)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-35)Description

Key defines whether the key should be used for keys.

### [](#couchbaseencryptionkeys-spec-usage-log)couchbaseencryptionkeys.spec.usage.log

#### [](#constraints-36)Constraints

**Required**

**Type**: `boolean`

**Default**: `True`

#### [](#description-36)Description

Log defines whether the key should be used for logs.