medium riskRotation

Secret rotation

Rotate secrets in the vault and roll them out via the External Secrets Operator.

Change scope

Registry creds, dataset tokens, service credentials

Maintenance impact

None if synced live; workloads pick up new secrets on restart.

Prerequisites
  • ·Secrets managed in Vault / cloud secret manager
  • ·ESO installed
Pre-checks
  • ·Identify consumers of the secret
Procedure
  1. 1

    Create the new secret version in the vault.

  2. 2

    Let ESO sync; trigger a rolling restart of consumers if needed.

    bash
    kubectl rollout restart deploy/$APP -n $NS
Validation
  • ✓Consumers authenticate with the new secret
  • ✓Old version revoked
Rollback

Re-point ESO to the previous version and re-sync.

Communication

Note the rotation; coordinate any consumer restarts.