<p>Hey I have a wider problem as when I update secrets in kubernetes they are not implemented in pods unless they are ugprades/reschedules or just re-deployed; I saw the other stackoverflow post about it but noone of the solutions fit me <a href="https://stackoverflow.com/questions/37945800/update-kubernetes-secrets-doesnt-update-running-container-env-vars">Update kubernetes secrets doesn&#39;t update running container env vars</a></p>
<p>Also so the in-app solution of python script on pod to update its secret automatically <a href="https://medium.com/analytics-vidhya/updating-secrets-from-a-kubernetes-pod-f3c7df51770d" rel="nofollow noreferrer">https://medium.com/analytics-vidhya/updating-secrets-from-a-kubernetes-pod-f3c7df51770d</a> but it seems like a long shot and I came up with solution to adding annotation to deployment manifest - and hoping it would re-schedule pods everytime a helm chart would put a new timestamp in it - it does put it but it doesn't reschedule - any thought how to force that behaviour ?</p>
<pre class="lang-sh prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: xxx
  namespace: xxx
  labels: xxx
  annotations:
    lastUpdate: {{ now }}
</code></pre>
<p>also I dont feel like adding this patch command to ci/cd deployment, as its arbitraty and - well doesnt feel like right solution</p>
<pre class="lang-sh prettyprint-override"><code>kubectl patch deployment mydeployment -p '{&quot;spec&quot;:{&quot;template&quot;:{&quot;spec&quot;:{&quot;containers&quot;:[{&quot;name&quot;:&quot;mycontainer&quot;,&quot;env&quot;:[{&quot;name&quot;:&quot;RESTART_&quot;,&quot;value&quot;:&quot;'$(date +%s)'&quot;}]}]}}}}'
</code></pre>
<p>didn't anyone else find better solution to re-deploy pods on changed secrets ?</p>

potatopotato
<p>Kubernetes by itself does not do rolling update of a deployment automatically when a secret is changed. So there needs to a controller which will do that for you automatically. Take a look at <a href="https://github.com/stakater/Reloader" rel="noreferrer">Reloader</a> which is a controller that watches if some change happens in ConfigMap and/or Secret; then perform a rolling upgrade on relevant DeploymentConfig, Deployment, Daemonset and Statefulset.</p>
<p>Add <code>reloader.stakater.com/auto</code> annotation to the deployment with name <code>xxx</code> and have a ConfigMap called <code>xxx-configmap</code> or Secret called <code>xxx-secret</code>.</p>
<p>This will discover deployments/daemonsets/statefulset automatically where xxx-configmap or xxx-secret is being used either via environment variable or from volume mount. And it will perform rolling upgrade on related pods when <code>xxx-configmap</code> or <code>xxx-secret</code> are updated</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: xxx
  namespace: xxx
  labels: xxx
  annotations:
    reloader.stakater.com/auto: &quot;true&quot;
</code></pre>
