code: func (s *Server) GetUnlockKey(ctx context.Context, request *api.GetUnlockKeyRequest) (*api.GetUnlockKeyResponse, error) {
  	// This directly queries the store, rather than storing the unlock key and version on
  	// the `Server` object and updating it `updateCluster` is called, because we need this
  	// API to return the latest version of the key.  Otherwise, there might be a slight delay
  	// between when the cluster gets updated, and when this function returns the latest key.
  	// This delay is currently unacceptable because this RPC call is the only way, after a
  	// cluster update, to get the actual value of the unlock key, and we don't want to return
  	// a cached value.
  	resp := api.GetUnlockKeyResponse{}
  	s.store.View(func(tx store.ReadTx) {
  		cluster := store.GetCluster(tx, s.clusterID)
  		resp.Version = cluster.Meta.Version
  		if cluster.Spec.EncryptionConfig.AutoLockManagers {
  			for _, encryptionKey := range cluster.UnlockKeys {
  				if encryptionKey.Subsystem == ManagerRole {
  					resp.UnlockKey = encryptionKey.Key
  					return
  				}
  			}
  		}
  	})
  
  	return &resp, nil
  }
docs: // GetUnlockKey is responsible for returning the current unlock key used for encrypting TLS private keys and
  // other at rest data.  Access to this RPC call should only be allowed via mutual TLS from managers.