A changed Secret does not reach a running pod's environment

After Flux applies a rotated Secret, the pod keeps the old value in its environment until it restarts. A 302 from the app does not prove the new password works.

I rotated a dashboard’s basic-auth password. The password lives in a SOPS-encrypted Secret, loaded into the container with envFrom. I merged the change, and Flux reconciled and reported the new revision as applied.

The pod was 19 hours old and still had the old password. Environment variables are read when the container starts, and a Secret that changes underneath doesn’t alter them. Files mounted from a Secret get updated eventually; variables never do.

kubectl -n <ns> rollout restart deployment/<name>

The deployment uses the Recreate strategy, so there is a short gap while the old pod stops and the new one starts. The app is also a chat bot, and in my setup Telegram messages sent while it is down are dropped.

Checking it worked

Don’t read much into a plain curl of the site. The dashboard answered 302 before and after, which only shows it is up. Log in with the new password in a browser.

The restart is the only step. The password wasn’t stored anywhere else: not in the app’s config file, and not in the annotations that a dashboard reads from the ingress route. The clients (browser, password manager) just need the new value.