Minimizing traffic drop when rekeying in a distributed security group

1. A computer-implemented method, comprising:

receiving a first request to generate a new encryption key for a security group to replace a current encryption key for the security group, the security group including a plurality of hosts that each encrypt and decrypt communications using the current encryption key;

in response to receiving the first request, determining that a threshold period following generation of the current encryption key has not expired;

in response to determining that the threshold period has not expired, delaying execution of the first request until the expiration of the threshold period; and

in response to the expiration of the threshold period following the generation of the current key, executing the first request by

generating the new encryption key,

storing a time of creation of the new encryption key, and

transmitting the new encryption key to the plurality of hosts.

2. The computer-implemented method of claim 1 , further comprising:

receiving, subsequent to the first request, a second request to generate a new encryption key for the security group to replace the current encryption key; and

in response to determining that the first request has not yet been executed, discarding the second request.

3. The computer-implemented method of claim 2 , wherein determining that the first request has not yet been executed includes determining that the current key is set to expire at an end of the threshold period.

4. The computer-implemented method of claim 1 , wherein the current key is configured with a lifetime, expiration of the lifetime triggering an automatic generation of a new key, and wherein delaying the execution of the first request includes setting the lifetime of the current key to expire at completion of the threshold period.

5. The computer-implemented method of claim 1 , further comprising:

determining, for each host, an amount of time needed to transmit data to the host;

determining a difference between a longest amount of time to transmit data to a host and a shortest amount of time to transmit data to a host; and

setting the threshold period to the determined difference.

6. The computer-implemented method of claim 1 , wherein storing the time of creation of the new encryption key includes storing the time of creation of the new encryption key to distributed consistent storage accessible to each of the plurality of hosts.

7. The computer-implemented method of claim 1 , wherein storing the time of creation of the new encryption key includes deleting a time of creation of the current encryption key.

8. A non-transitory computer-readable medium storing instructions, which when executed by a processing device, cause the processing device to perform a method comprising:

receiving a first request to generate a new encryption key for a security group to replace a current encryption key for the security group, the security group including a plurality of hosts that each encrypt and decrypt communications using the current encryption key;

in response to receiving the first request, determining that a threshold period following generation of the current encryption key has not expired;

in response to determining that the threshold period has not expired, delaying execution of the first request until the expiration of the threshold period; and

in response to the expiration of the threshold period following the generation of the current key, executing the first request by

generating the new encryption key,

storing a time of creation of the new encryption key, and

transmitting the new encryption key to the plurality of hosts.

9. The non-transitory computer-readable medium of claim 8 , the method further comprising:

receiving, subsequent to the first request, a second request to generate a new encryption key for the security group to replace the current encryption key; and

in response to determining that the first request has not yet been executed, discarding the second request.

10. The non-transitory computer-readable medium of claim 9 , wherein determining that the first request has not yet been executed includes determining that the current key is set to expire at an end of the threshold period.

11. The non-transitory computer-readable medium of claim 8 , wherein the current key is configured with a lifetime, expiration of the lifetime triggering an automatic generation of a new key, and wherein delaying the execution of the first request includes setting the lifetime of the current key to expire at completion of the threshold period.

12. The non-transitory computer-readable medium of claim 8 , the method further comprising:

determining, for each host, an amount of time needed to transmit data to the host;

determining a difference between a longest amount of time to transmit data to a host and a shortest amount of time to transmit data to a host; and

setting the threshold period to the determined difference.

13. The non-transitory computer-readable medium of claim 8 , wherein storing the time of creation of the new encryption key includes storing the time of creation of the new encryption key to distributed consistent storage accessible to each of the plurality of hosts.

14. The non-transitory computer-readable medium of claim 8 , wherein storing the time of creation of the new encryption key includes deleting a time of creation of the current encryption key.

15. A central controller comprising:

a processing device; and

a memory coupled to the processing device, the memory storing instructions which, when executed by the processing device, cause the central controller to:

receive a first request to generate a new encryption key for a security group to replace a current encryption key for the security group, the security group including a plurality of hosts that each encrypt and decrypt communications using the current encryption key;

in response to receiving the first request, determine that a threshold period following generation of the current encryption key has not expired;

in response to determining that the threshold period has not expired, delay execution of the first request until the expiration of the threshold period; and

in response to the expiration of the threshold period following the generation of the current key, execute the first request by

generating the new encryption key,

storing a time of creation of the new encryption key, and

transmitting the new encryption key to the plurality of hosts.

16. The central controller of claim 15 , wherein the instructions further cause the central controller to:

receive, subsequent to the first request, a second request to generate a new encryption key for the security group to replace the current encryption key; and

in response to determining that the first request has not yet been executed, discard the second request.

17. The central controller of claim 16 , wherein determining that the first request has not yet been executed includes determining that the current key is set to expire at an end of the threshold period.

18. The central controller of claim 15 , wherein the current key is configured with a lifetime, expiration of the lifetime triggering an automatic generation of a new key, and wherein delaying the execution of the first request includes setting the lifetime of the current key to expire at completion of the threshold period.

19. The central controller of claim 15 , wherein the instructions further cause the central controller to:

determine, for each host, an amount of time needed to transmit data to the host;

determine a difference between a longest amount of time to transmit data to a host and a shortest amount of time to transmit data to a host; and

set the threshold period to the determined difference.

20. The central controller of claim 15 , wherein storing the time of creation of the new encryption key includes storing the time of creation of the new encryption key to distributed consistent storage accessible to each of the plurality of hosts.