API key rotation via Secret

Secrets belong in a Secret. That sounds obvious until you find keys in a committed YAML, in a container image, or copy-pasted into a Deployment env field. The cluster gives you a first-class object for this. Use it.

k8s/secret.yaml.example

yaml

# Never commit the real file. Copy to secret.yaml, fill in, apply.
apiVersion: v1
kind: Secret
metadata:
  name: enterprise-rag-secrets
  labels:
    app: enterprise-rag
type: Opaque
stringData:
  OPENROUTER_API_KEY: 'REPLACE_ME'

stringData lets you type the value in plain text. Kubernetes base64-encodes it for you. Commit the .example file, keep the real secret.yaml out of git via .gitignore.

terminal

bash

# Create or rotate a key without touching any YAML on disk
kubectl create secret generic enterprise-rag-secrets \
  --from-literal=OPENROUTER_API_KEY=sk-or-new-key \
  --dry-run=client -o yaml | kubectl apply -f -

# Restart pods to pick up the new key (env is read at process start)
kubectl rollout restart deployment/enterprise-rag

The --dry-run plus apply trick gives you an in-place update. A rollout restart cycles pods so the new env is picked up. No committed key, no manual YAML edit, no audit trail gap.

Quiz: Quiz

Loading practice…