Changing credentials without downtime.
WHAT THE PROBLEM IS
Changing a credential invalidates the old one, and running instances hold it.
WHAT THAT CAUSES
Failures until every instance restarts.
WHAT THE SAFE PATTERN IS
Issue a new credential Make both valid Deploy configuration using the new one Confirm nothing uses the old Revoke the old
WHY BOTH MUST BE VALID BRIEFLY
Otherwise the change is an outage.
WHAT THAT REQUIRES OF THE PROVIDER
Support for two active credentials.
WHAT TO CHECK BEFORE PLANNING ANY ROTATION
Whether it does.
WHAT TO DO WHEN IT DOES NOT
Schedule a brief window, and accept it.
WHAT MOUNTED SECRETS PROVIDE
Updates without a restart, if the application re-reads the file.
WHAT MOST APPLICATIONS DO
Read once at startup.
WHAT THAT MEANS
A restart is needed, and should be deliberate.
HOW TO TRIGGER IT CLEANLY
A rolling restart of the deployment.
WHAT TO AUTOMATE
Rotation itself, on a schedule.
WHY
Manual rotation is postponed indefinitely.
WHAT TO MONITOR
Credential age Failures after rotation
WHAT TO DO WHEN A SECRET LEAKS
Rotate immediately, accepting the disruption.
WHAT TO RECORD
What was rotated, when, and by whom.
