anchor.diff:    path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/cc/database_encryption?
     value: &encryption_info
       keys:
  -      encryption_key_0: "example-random-key-string"
  -    current_key_label: "encryption_key_0"
  +      <%= encryption_key %>: "example-random-key-string"
  +    current_key_label: "<%= encryption_key %>"
   
   - type: replace
     path: /instance_groups/name=cc-worker/jobs/name=cloud_controller_worker/properties/cc/database_encryption?
  
positive.code: 
  In order to rotate an encryption key:
  
  1. Add a new encryption key to the list of `keys` (e.g. `encyption_key_1` below).
  1. Update the `current_key_label` to be the label of the new encryption key (e.g. updating the `current_key_label` to be `"encryption_key_1"` below).
  
      The following is an example of an ops file used for rotation:
  
  
negative.code: ---
  
  <strong><%= modified_date %></strong>
  
  <%
    require 'date'
  
    yesterday = Date.today.prev_day.strftime('%Y_%m_%d')
    today = Date.today.strftime('%Y_%m_%d')
  
    encryption_key = "encryption_key_#{yesterday}"
    rotated_key = "encryption_key_#{today}"
  %>
  
  This topic describes how operators can encrypt sensitive data in the Cloud Controller (CC) database using operator-provided keys.
  
  