Demo: rotating a database password without downtime
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
rotate the orders database credential while traffic runs. Prepares MID-054-LAB1.
Draft outline details
Step by step
- Show the current setup: the password is stored in the secrets manager and read by
ordersvia workload identity. - Create a second database user (or a second password) so two credentials are valid at once.
- Update the secret; let
orderspick up the new value and rebuild its connection pool. - Planned mistake: change the database password first, before the app has the new one; connections fail. Fix: add the new credential, switch the app, then revoke the old one.
- Confirm no failed requests in the dashboard and run a scan showing no secret in the image, manifests, or Git.
Check your understanding
What is the safe order of a rotation?
Show answer
Add new credential, switch the app, revoke the old.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.