Secrets Distribution Service  ·  View 06 of 34  ·  2 · People and journeys

Journey — Rotate Past a Straggler

A partner API key nears its maximum age. Rotation has to complete without an outage, and without forgetting the batch job that reads it once a month.

Editable source SVG draw.io All views
Secret owner payments partner key Goal — Replace a partner API key with no outage Trigger — Key reaches 80% of its 90-day maximum age Done when — Old key destroyed, nobody broken, nobody forgotten 1 · Due 2 · Stage 3 · Verify ◆ moment of truth 4 · Overlap 5 · Straggler ◆ moment of truth 6 · Retire What they do Gets overdue warning Starts the rotation Watches the test call Watches consumers move Chases a monthly job Confirms destruction System behind it Inventory Rotation controller Partner API Agent version reports Observed-use report Custody · both sites How it feels Confident Unsure Frustrated Where it hurts Partner allows two keys Test call rate-limited Job reads once a month What the platform gives Warned at 80% of age Both keys valid 24 h+ Abort keeps old key Version held per pod Straggler named · day 7 Destruction audited Journey — A Secret Owner Rotates a Partner Key Past a Straggler v 1.0 · owner Security Platform Architecture · date 2026-09

The trough

  • The overlap window ends and one consumer still uses the old key: a monthly job running from a file. Waiting for it is unbounded; retiring on schedule breaks it.
  • Answer: retirement waits on observed use, with a seven-day ceiling. The straggler is named to its owner on day one and broken, deliberately and visibly, on day seven (ADR-23).

What keeps it routine

  • The new version is written to both sites before either serves it, and verified against the partner with a real call. A failed verification aborts and leaves the old key live, so a rotation can never leave zero working keys.
  • Agents report the version each workload holds, and the partner's key-usage report confirms it. Both have to agree before retirement.

Assumptions

  • The partner permits two active keys. Where a partner allows one, the secret is registered as manual rotation with a named owner, and emergency rotation is accepted to be breaking.
◀  Journey — Contain a Leaked Credential All views Layered Architecture  ▶
Solution Architecture v1.0 · Security Platform Architecture · 2026-09 · 34 views · open source, fully on-premises06-journey-rotate-a-key-past-a-straggler