<p>I want to learn how to update secrets in worker pods without killing and recreating the deployment.</p>

<p>Currently pods pull in secrets to as env vars with:</p>

<pre><code>        env:
        - name: SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              key: secret_access_key
              name: secrets
</code></pre>

<p>but this only happens when they startup.</p>

<p>So if there is a need to change a secret I have to:</p>

<ol>
<li>Change the secret in <code>secrets.yaml</code></li>
<li><code>kubectl apply -f secrets.yaml</code></li>
<li><code>kubectl delete -f worker-deployment.yaml</code></li>
<li><code>kubectl apply -f worker-deployment.yaml</code></li>
</ol>

<p>I really don't like step 3 and 4 as they terminate jobs in progress.</p>

<p>What is a better workflow for updating env var secrets in place?</p>

<p>There is no way to do a "hot reload" for pod's environment variables.</p>

<p>Although, you do not need to delete and recreate the deployment again to apply the new secret value. You only need to recreate the underlying pods. Some options are:</p>

<ul>
<li><code>kubectl delete pods</code> to recreate them</li>
<li>Editing some deployment trivial value to trigger a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#updating-a-deployment" rel="noreferrer">Rolling Update</a> (e.g., <a href="https://gist.github.com/jmound/ff6fa539385d1a057c82fa9fa739492e" rel="noreferrer">changing the <code>terminationGracePeriodSeconds</code></a> from <code>30</code> to <code>31</code>).</li>
<li>Use <code>kubectl rollout restart</code> to do a rolling restart on the deployment †</li>
</ul>

<p><em>† <code>rollout restart</code> is only available on kubernetes <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.15.md#cli-improvements" rel="noreferrer">v1.15+</a></em></p>
