I’m looking for information on how key management is implemented in YB (meaning YugabyteDB itself). In general, and in particular when using block-level encryption at rest, how are the keys stored? What happens when the Database is being stopped and then restarted? Do the keys have to be provided by an admin on restart? And if not, how does YB make sure the keys are securely stored (without e.g. some sort of master key)?
We have this RFC about some of the implementation internals as well as docs on how to enable encryption/rotate keys.
This tech talk also covers these topics: Encryption at Rest in YugabyteDB | YugabyteDB Friday Tech Talks | Episode 30