All of the catalog
Scenario
Secrets Management & Rotation
go-api consumes a Vault-backed secret synced by External Secrets. Stage 1 wires the sync and seeds a baseline value; stage 2 rotates it in Vault. A check verifies the new value propagated to the Kubernetes Secret with no redeploy.
SecurityVerifiedk3dkind
Definition on GitHubWhat you'll do
- Sync a Vault KV secret into a Kubernetes Secret via External Secrets
- Rotate the secret in Vault and watch it propagate without a redeploy
- Treat rotation, not redeploy, as the way secrets change
Stages
- 1consume
Wire the Vault->ESO->Secret sync and seed a baseline value
es-wiringseed-baseline - 2rotate
Rotate the value in Vault and let ESO propagate it
rotate-secret
Prerequisites
These are installed into the lab cluster for you — listed so you know what the scenario actually depends on.
secrets/vaultsecrets/external-secretsgo-api
Related scenarios
- Security & CompliancePolicy enforcement with Kyverno, TLS certificates via cert-manager, encrypted secrets with Sealed Secrets, namespace network isolation, and security best-practice policies.
- Autoscaling Under LoadWatch KEDA scale go-api on Prometheus RPS: a spike drives it from 1 to several replicas, then cooldown brings it back. The flagship 'autoscaling actually works' demo, verified under traffic from the load generator.
- Chaos EngineeringFailure injection with Chaos Mesh — pod kills, network delays, CPU/memory stress, partitions. Correlate chaos experiments with application metrics via Grafana dashboard.