5 ms·

Hi! OAuth token refresh is handled within the profile, and will automatically get picked up by agents using it. If you actually want to pull or rotate a credent

by bwm 2mo ago

Hi! OAuth token refresh is handled within the profile, and will automatically get picked up by agents using it. If you actually want to pull or rotate a credential, you can do that too and re-inject. The pattern that's increasingly common is having a pilot or orchestrator agent sitting on top of the fleet that manages this.

bobbylarson 2mo ago
The profile-plus-orchestrator pattern is a clean answer, and re-inject existing at all puts you ahead of most setups I have seen. The remaining edge: a process that read the credential at boot still holds the old value in memory after a pull. Is re-inject a workload restart, or does something force consumers to re-read? That is the part I have never seen solved cleanly without short TTLs.