This environment variable provides the encryption key from the primary cluster, required to read encrypted data from the primary GCS bucket during recovery. Unlike other GCP_RECOVER_FROM_* variables, this value is passed via secretKeyRef (from the dr-secondary-gcs-storage-encryption Kubernetes secret) rather than as a plain value, to avoid exposing it in the pod spec.

It is injected into the HumioCluster pod spec by Terraform when var.dr != "" and is preserved across both standby and active DR modes to prevent pod recreation during promotion.