Every secret tells a story. It was created by someone, delivered through a path, copied into one or more systems, used by an identity, and eventually replaced—or forgotten. The longer that story becomes, the harder it is to know who can still read it and what will break when it changes.
Prefer identity over possession
When a platform can issue short-lived credentials from workload identity, use that path. The workload proves what it is and receives only the access it needs for a limited time. There is no static value to place in a repository, image, deployment variable, or operator notebook.
Static secrets remain necessary in some integrations. Treat them as exceptions with a named owner, purpose, storage location, consumers, and expiration expectation.
Make delivery narrow and observable
A secret manager improves storage but does not automatically improve use. Limit which runtime identity can retrieve each value. Avoid exposing secrets as broad environment state when a process-specific or file-mounted delivery method is available. Log retrieval without logging the value itself.
The safest secret is the one that is never created. The next safest is short-lived, narrowly delivered, and easy to revoke.
Rotation is a systems test
Rotation fails when a hidden consumer still depends on the old value. Automate the sequence, support overlap where the protocol allows it, and verify consumers before revocation. A credential that cannot be rotated safely is revealing tight coupling in the system.
Practice emergency rotation separately from routine rotation. The emergency path should not depend on the same potentially compromised identity or pipeline.
Delete the story’s loose ends
Removing the source value is not enough if copies remain in build logs, old artifacts, shell history, backups, or tickets. Prevention is more reliable than cleanup: mask pipeline output, scan changes before merge, restrict artifact retention, and teach tooling to reject known credential patterns.
A good secret lifecycle is intentionally boring. Creation is controlled, use is narrow, rotation is routine, and expiration is expected. Short stories are easier to verify.