From f36bcd1602a5c4d868a80f873520317abf06f9f2 Mon Sep 17 00:00:00 2001 From: thesabear Date: Wed, 26 Aug 2026 18:41:03 +0300 Subject: [PATCH] docs: update secrets-lifecycle diagram --- assets/secrets-lifecycle.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/secrets-lifecycle.svg b/assets/secrets-lifecycle.svg index a499df0..0a14f28 100644 --- a/assets/secrets-lifecycle.svg +++ b/assets/secrets-lifecycle.svg @@ -1,4 +1,4 @@ -
Vault Agent
runs on the consuming host
Vault
server
Local Disk
rendered file
Application
① authenticate — AppRole (role_id + secret_id)
② short-lived token issued, cached, auto-renewed
③ secret/cert requested + rendered to file (0600, root-owned, gitignored)
④ app reads the local file — never talks to Vault directly
⑤ rotation (async): update once in Vault → picked up on next render, no redeploy
Solid = the initial bootstrap sequence, in order. Dashed = the separate, periodic rotation cycle — asynchronous, never a blocking dependency for the application.
 \ No newline at end of file +
Vault Agent
runs on the consuming host
Vault
server
Local Disk
rendered file
Application
① authenticate — AppRole (role_id + secret_id)
② short-lived token issued, cached, auto-renewed
③ secret/cert requested + rendered to file (0600, root-owned, gitignored)
④ app reads the local file — never talks to Vault directly
⑤ rotation (async): update once in Vault → picked up on next render, no redeploy
Solid = the initial bootstrap sequence, in order. Dashed = the separate, periodic rotation cycle — asynchronous, never a blocking dependency for the application.
 \ No newline at end of file