Rotate a Secret and Restart Its Consumers
A 4-step recipe with Kubernetes. We can help you get access.
Recipe · 4 steps
Rotate a Secret and Restart Its Consumers
with Kubernetes · Configuration & Secrets Management
Write a rotated Secret and roll the deployment that consumes it.
- List the namespace's secrets to record what exists before the rotation, which gives the run an auditable before state.
- Write the rotated credential using stringData so plain-text values are encoded by the API server rather than by the caller.
- Read the deployment that consumes the secret and capture its resourceVersion so the restart write is concurrency-safe.
- Replace the deployment with a changed pod-template annotation. The template change is what triggers the rolling restart; pods remount the secret and read the rotated value on start.
What you'll need to have ready
- namespace: The namespace holding the secret and its consuming deployment.
- secretName: Name of the Secret to write.
- secretStringData: Plain-text key/value pairs; the API server base64-encodes them on write.
- secretType: Secret type — Opaque, kubernetes.io/tls, or kubernetes.io/dockerconfigjson.
- deploymentName: The deployment whose pods consume the secret.
- appName: The app label value used by the deployment selector and pod template.
- image: Container image to preserve on the replaced deployment.
- replicas: Replica count to preserve on the replaced deployment.
- rotationStamp: Value written to the rollout annotation to force a restart. Any value that changes per rotation works, such as a timestamp.
For your developer
Arazzo workflow kubernetes:rotate-secret, 4 operations: listNamespacedSecrets → createNamespacedSecret → getNamespacedDeployment → replaceNamespacedDeployment. Specs on APIs.io.