Hacker News new | past | comments | ask | show | jobs | submit login

By centralising the secrets storage, you make it easier to change the secrets in one place rather than having to change a bunch of variables everywhere.

As for how you change the secrets? You should have some automated way of pulling the current secret out of the vault, storing a future secret in the vault, performing an upgrade of the secrets, verifying the new secrets are deployed everywhere, and then moving the "future secret" into "current secret" and keeping a historical copy of the "previous secret".

Whatever configures your infrastructure automatically will already need to have root access to everything and so that's a good place to implement the rotation.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: