| object_metadata_1 |               | object_metadata_2 |
                    +-------------------+               +-------------------+
```

#### Key rotation - Basic Operation

//go:generate msgp -file $GOFILE -unexported

// BatchKeyRotationType defines key rotation type
type BatchKeyRotationType string

const (
	sses3  BatchKeyRotationType = "sse-s3"
	ssekms BatchKeyRotationType = "sse-kms"
)

// BatchJobKeyRotateEncryption defines key rotation encryption options passed
type BatchJobKeyRotateEncryption struct {
	Type       BatchKeyRotationType `yaml:"type" json:"type"`

func (opts Config) ReplicationWait() time.Duration {
	configMu.RLock()
	defer configMu.RUnlock()

	return opts.ReplicationWorkersWait
}

// KeyRotationWait returns the duration for which a batch key-rotation worker
// would wait before working on next object.
func (opts Config) KeyRotationWait() time.Duration {
	configMu.RLock()
	defer configMu.RUnlock()

	return opts.KeyRotationWorkersWait
}

   change the cluster root credentials since they were used to en/decrypt the IAM data.
   So, both - the old and new credentials - had to be present at the same time during a rotation
   and the old credentials had to be removed once the rotation completed. This process is now gone.
   The root credentials can now be changed easily.

> Does this mean I need an enterprise KMS setup to run MinIO (securely)?

      assignees.push('hawkinsp', 'yashk2810', 'skye');
    }
    if (lowercased_title.includes('xla') || lowercased_title.includes('gpu')) {
      assignees.push('cheshire', 'gcforster', 'reedwm', 'chsigg', 'xla-rotation');
    }
    if (lowercased_title.includes('tf')) {
      assignees.push('rohan100jain', 'bfontain');
    }
  }
  if (lowercased_title.includes('linaro') && domain.includes('linaro.org')) {

    for (int i = fromIndex, j = toIndex - 1; i < j; i++, j--) {
      byte tmp = array[i];
      array[i] = array[j];
      array[j] = tmp;
    }
  }

  /**
   * Performs a right rotation of {@code array} of "distance" places, so that the first element is
   * moved to index "distance", and the element at index {@code i} ends up at index {@code (distance

    - **Pilot** - Responsible for configuring the proxies at runtime.

    - **Citadel** - Responsible for certificate issuance and rotation.

    - **Galley** - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.

- **Operator** - The component provides user friendly options to operate the Istio service mesh.

    for (int i = fromIndex, j = toIndex - 1; i < j; i++, j--) {
      boolean tmp = array[i];
      array[i] = array[j];
      array[j] = tmp;
    }
  }

  /**
   * Performs a right rotation of {@code array} of "distance" places, so that the first element is
   * moved to index "distance", and the element at index {@code i} ends up at index {@code (distance

the certificates are persisted to disk, rather than kept in memory like in the standard Kubernetes deployment.

## Certificate Rotation

The agent also handles rotating certificates near expiration. It does so by triggering a callback from the `SecretManager` to the SDS server

    for (int i = fromIndex, j = toIndex - 1; i < j; i++, j--) {
      char tmp = array[i];
      array[i] = array[j];
      array[j] = tmp;
    }
  }

  /**
   * Performs a right rotation of {@code array} of "distance" places, so that the first element is
   * moved to index "distance", and the element at index {@code i} ends up at index {@code (distance