backport of commit afdf42b

website/content/docs/commands/operator/rotate.mdx

@@ -10,14 +10,18 @@ description: |-
 
 # operator rotate
 
-The `operator rotate` rotates the underlying encryption key which is used to
-secure data written to the storage backend. This installs a new key in the key
-ring. This new key is used to encrypted new data, while older keys in the ring
-are used to decrypt older data.
+The `operator rotate` command rotates the underlying encryption key, which
+secures data written to storage. This installs a new key in the key ring. 
+This new key encrypts new data, while older keys in the ring decrypt
+older data.
 
-This is an online operation and does not cause downtime. This command is run
+This is an online operation and does not cause downtime. This command runs
 per-cluster (not per-server), since Vault servers in HA mode share the same
-storage backend.
+storage.
+
+As of **Vault 1.7**, Vault will automatically rotate the encryption key before
+reaching 2<sup>32</sup> encryption operations, in adherence with NIST SP800-32D
+guidelines.
 
 ## Examples
 
@@ -29,6 +33,26 @@ Key Term        3
 Install Time    01 May 17 10:30 UTC
 ```
 
+View the current automatic rotation policy:
+
+```shell-session
+$ vault read sys/rotate/config
+```
+
+Configure a time interval for automatic key rotation:
+
+```shell-session
+$ vault write sys/rotate/config interval=2160h
+Success! Data written to: sys/rotate/config
+```
+
+Configure the maximum number of encryption operations per key:
+
+```shell-session
+$ vault write sys/rotate/config max_operations=123456789
+Success! Data written to: sys/rotate/config
+```
+
 ## Usage
 
 The following flags are available in addition to the [standard set of