No dedicated repository. Secret/certificate lifecycle is documented here; workload identity and mTLS consumption live in the Zero Trust mesh case.
Case 16 · Pattern
Secrets and Certificate Automation
Sensitive material with a lifecycle: automated issue, inject, rotate, and expiry warnings — keyrings and calendars instead of forever tokens.
00
Evidence home
Pattern case — proof lives next door.
01
How it works
Rotate the keyring — renew before expiry.
Secrets and Certificate Automation by Andrey Lesnikov — lifecycle-managed credentials that warn before they die.
-
01
Issue from a system of record
Secrets and certs are minted by automation — not pasted from a password manager into prod.
-
02
Inject at runtime
Workloads receive material through platform injection paths — ESO / cert-manager style contracts.
-
03
Rotate on a schedule
Keyrings turn before humans remember they should. Forever tokens are a bug.
-
04
Watch the calendar
Expiry windows pulse into alerts early enough to renew without an outage ceremony.
02
Evidence
From problem to proof.
How the system is framed, operated, and proven — not a slide deck summary.
01
Rotation and renewals are manual — outage risk hides in certificates and scattered secrets.
02
You need mesh mTLS or endpoint inventory more than secret delivery — see Zero Trust Service Mesh or FleetDM.
03
Zero Trust Service Mesh consumes workload identity cleanly. Policy as Code Guardrails prevents unsafe secret mounts at admit time.
Constraints
Rotation cadence, Kubernetes consumption, identity boundaries, audit trail, renewals, and emergency revocation.
03
Related
Nearby systems.
Zero Trust Service Mesh
Internal traffic is often trusted by default, making lateral movement and policy gaps hard to see
East-west mTLS by default
Policy as Code Guardrails
Security and platform rules are often discovered only after deployment or during reviews
Standards enforced in CI, not slides
EKS Platform Foundation
Kubernetes clusters become inconsistent when networking, identity, ingress, storage, and observability are assembled per project
Clusters as a repeatable product
Available for meaningful infrastructure conversations