Docs

Partitions

A partition is a separate key space with its own wrap key, derived inside the box. Keys in one partition cannot be used, listed or moved from another. Partitions are included; create as many as you need.

Create and label

roost partition create prod --env prod
roost partition create dev  --env dev
roost partition create payments --env prod --approvers security-officers:2

A partition labelled prod never accepts a key from a dev partition, and a prod key cannot be copied into dev. The label is part of the wrap, not a setting.

Temporary partitions for CI

A test run gets its own partition with a lifetime. When the lifetime ends, the partition and every key in it are gone, whether or not the run finished.

roost partition create ci-build-842 --ttl 30m
roost key create --purpose code-signing --name ci-build-842-sign --partition ci-build-842
# ... run the tests ...
# nothing to clean up: the partition expires on its own

Delete a partition

Deleting a partition discards its wrap key. Every key in it becomes unusable at once, including copies in backups. Deletion needs the partition's approval policy and is recorded.