diff --git a/assets/secrets-lifecycle.svg b/assets/secrets-lifecycle.svg index 461b789..452d55a 100644 --- a/assets/secrets-lifecycle.svg +++ b/assets/secrets-lifecycle.svg @@ -1,4 +1,4 @@ -
Vault Agent
runs on the consuming host
Vault
server
Local Disk
rendered file
Application
① authenticate — AppRole (role_id + secret_id)
② short-lived token issued, cached, auto-renewed
③ secret/cert requested + rendered to file (0600, root-owned, gitignored)
④ app reads the local file — never talks to Vault directly
⑤ rotation (async): update once in Vault → picked up on next render, no redeploy
Solid = the initial bootstrap sequence, in order. Dashed = the separate, periodic rotation cycle — asynchronous, never a blocking dependency for the application.
 \ No newline at end of file +
Vault Agent
runs on the consuming host
Vault
server
Local Disk
rendered file
Application
① authenticate — AppRole (role_id + secret_id)
② short-lived token issued, cached, auto-renewed
③ secret/cert requested + rendered to file (0600, root-owned, gitignored)
④ app reads the local file — never talks to Vault directly
⑤ rotation (async): update once in Vault → picked up on next render, no redeploy
Solid = the initial bootstrap sequence, in order. Dashed = the separate, periodic rotation cycle — asynchronous, never a blocking dependency for the application.
 \ No newline at end of file