🔑
Rotate secrets without downtime
DB creds, IRSA, TLS, API keys — dual-credential pattern and rolling restarts.
Reviewed: ·Tested on: Kubernetes 1.29, Terraform 1.8, Ubuntu 22.04
Symptoms
- Quarterly rotation policy due
- Compromised credential
- Go-live secrets item needs rotation plan
11. Pick rotation type
DB, IRSA, TLS, or API key — one at a time.
22. Issue new credential (keep old active)
# DB: create app_v2 user or new password
# API: generate new key in provider UI
# IRSA: create new IAM role, update SA annotation33. Update secret store + rollout
kubectl create secret generic app-secrets --from-literal=KEY=new -n apps --dry-run=client -o yaml | kubectl apply -f -
kubectl rollout restart deploy/myapp -n apps
kubectl rollout status deploy/myapp -n apps44. Verify + revoke old
# smoke test
curl -I https://app.example.com/health
# IRSA:
kubectl exec deploy/myapp -n apps -- aws sts get-caller-identity
# after 24h soak: revoke old DB user / API key