Secrets auto-rotation not implemented (manual only) #3
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
crates/patronus-secrets/src/manager.rs:293- when a secret needs rotation, the code logswarn!("Secret '{}' needs rotation but auto-rotation not implemented. Manual rotation required.").Fix needed: implement real auto-rotation for at least the secret types that support it (e.g. internally-generated API keys/certs) rather than requiring an operator to notice the warning and rotate manually.
Found during a real gap-analysis review, 2026-09-30.
Resolved: real auto-rotation is implemented in
crates/patronus-secrets/src/manager.rs(SecretManager::enforce_rotation_policy/auto_rotate_secret, commit 2234-erafeat(secrets): implement real auto-rotation in enforce_rotation_policy) and is actually invoked on an hourlytokio::spawnloop incrates/patronus-web/src/lib.rs(commit 2856,feat(secrets): actually invoke enforce_rotation_policy() periodically). Locally-rotatable types (VPN PSK, IPsec PSK, SNMP community, webhook secret) are auto-regenerated; everything else is still correctly routed toneeds_manual_rotationwith a reason, since this codebase cannot safely rotate externally-coordinated secrets unattended. No remaining gap against the original report. Closing.