Struct KeyRotator 

pub struct KeyRotator<B: SecretRotationBackend, E: KeyEncryptor + Clone, const V: usize = 256, const S: usize = 32> { /* private fields */ }

Background task that periodically generates and persists a new encryption key.

KeyRotator is the write side of the key-management system. It runs a single perpetual loop: sleep until the current key is due for rotation, generate a new key, encrypt it, and attempt a conditional insert via SecretRotationBackend::try_insert_key. If another instance raced ahead the insert is skipped and the loop simply sleeps until the new key expires.

Multiple KeyRotator instances for the same group_id can run concurrently (e.g. for high availability); the optimistic-locking protocol in try_insert_key ensures only one insert succeeds per rotation cycle.

Type parameters

• B — backend that implements SecretRotationBackend
• E — encryptor that implements KeyEncryptor
• V — ring buffer size (number of key slots, must be ≤ 256, default 256). Must match the V of any InMemorySecretGroup consuming the keys.
• S — key size in bytes (default 32)

Standalone use

KeyRotator can be used without a SecretSyncer or SecretManager. This is useful when you want a dedicated rotation service that writes to shared storage while other nodes only read:

let rotator: KeyRotator<_, _, 256, 32> = KeyRotator::new(
    "session-tokens",
    backend,
    Duration::from_secs(3600),
    Duration::from_secs(30),
    encryptor,
    || [0u8; 32],
);
rotator.run(CancellationToken::new()).await;

Implementations

impl<B: SecretRotationBackend, E: KeyEncryptor + Clone, const V: usize, const S: usize> KeyRotator<B, E, V, S>

pub fn new( group_id: impl Into<String>, backend: B, rotation_interval: Duration, propagation_delay: Duration, encryptor: E, generate_key: impl Fn() -> [u8; S] + Send + Sync + 'static, ) -> Self

Create a new KeyRotator.

Arguments

• group_id — identifies the logical key group in storage
• backend — implements SecretRotationBackend
• rotation_interval — how long a key is valid before a new one is generated
• propagation_delay — added to SystemTime::now() to compute activated_at for the new key, giving syncers time to pull the key before it becomes active
• encryptor — wraps key bytes before storage
• generate_key — produces fresh key material; defaults in SecretManager to a CSPRNG fill

Panics

Panics at compile time if V > 256 (versions are stored as u8).

pub async fn run(self, token: CancellationToken)

Run the rotation loop until token is cancelled.

This method consumes self and runs forever, sleeping between rotations. Pass the returned future to tokio::spawn or run it directly. Cancel token for a clean shutdown; the loop exits after the current sleep or retry delay completes.

On backend or encryption errors the rotator backs off for 30 seconds before retrying, so transient failures do not cause a tight error loop.