Advice on Service Principal's K8S secret rotation

[jonatiao]

Hello,

I'm looking for information regarding the following scenario.
I'm testing CSI driver + autorotation. It's working fine as far as I can tell. I'm using the Service Principal as a k8s secret, as described in this tutorial here:
https://mobb.ninja/docs/security/secrets-store-csi/azure-key-vault
This means I have a kind:secret with the SPN client_id and client_secret there.

kubectl create secret generic secrets-store-creds
-n my-application
--from-literal clientid=${SERVICE_PRINCIPAL_CLIENT_ID}
--from-literal clientsecret=${SERVICE_PRINCIPAL_CLIENT_SECRET}
kubectl -n my-application label secret
secrets-store-creds secrets-store.csi.k8s.io/used=true

Still, I wonder what will happen when I create a new secret for this SPN and then I update the secret k8s object.
--from-literal clientsecret=${SERVICE_PRINCIPAL_CLIENT_SECRET}

Will the autorotation still works? I mean, it will read the updated SPN's k8s secret everytime for each check againt azure kv?
Or
Do I need to restart/rollout my deployments because the previous secret is somehow in-memory somewhere?

thx!!

[aramase]

Will the autorotation still works? I mean, it will read the updated SPN's k8s secret everytime for each check againt azure kv?

that's right! the secret value is read by kubelet and passed to driver at every mount and autorotation call, so it will always be the latest.

[jonatiao]

Thx a lot!! : D