Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You could rotate the key (make available the new secret) before expiring the old. During that time (which can be even a few hours) you typically reload your application to use the new credential.

If you are able to change your application's code, you could integrate with vault's API directly which is the most clean solution. If you are unable, you can use [consul-template](https://github.com/hashicorp/consul-template) or [envconsul](https://github.com/hashicorp/envconsul) to securely introduce your secret which would entail reloading/restarting your application.



I think rotating with a little short-term redundancy is the simplest solution. That's what I've used myself too.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: