Updating the values in the KV Secrets Engine

[Ruchira-R]

Hiya, I wanted to know how the SecretsProviderClass will work with the Pod to update the values.

Currently, I'm using Secrets stored as ENV variables and wanted to understand how changes made to the value in Vault (In the KV Secrets Engine) will affect these ENV variables set.
How will they (The ENV Vars) get updated? Will they be updated as soon as a change is made in the Pod which is running OR Will the pod need to terminated with a new pod being spun up in place, which will use the new Secret with the value being updated?

[tomhjp]

Good question: firstly you need to make sure you're using the CSI driver's auto rotation feature if you want any updates: https://secrets-store-csi-driver.sigs.k8s.io/topics/secret-auto-rotation.html. However, that only works for files and synced Kubernetes secrets. If you're reading the secret value as an environment variable, the pod needs to be restarted to see the change.