Re-encrypting secrets after rotation of Vault transit encryption key

[Shmooty]

It sounds like if you have Vault rotating its transit encryption key, and you enforce that Vault would only keep say 5 old key versions in its active keyring, then you'd need to re-encrypt all Kubernetes secrets before the 5th transit encryption key is pushed to archive (out of active keyring) and no longer can do decryption.

Am I right in thinking you could simply do this via a cron job on a host with kubectl and --all-namespace access to force reapply all secrets in Kubernetes?

kubectl get secrets --all-namespaces -o json | kubectl replace -f -

I'd think this would then force Vault to decrypt all secrets, and then re-encrypt the new secrets (replace of same ones), which effectively gets you freshly encrypted secrets?

Is this the correct method for re-encrypting kubernetes secrets via the Vault KMS provider?