<p>Is it possible to do SQL Server secret rotations?</p>

<p>Scenario:</p>

<ul>
<li><p>CI/CD pipes with helm chart for SQL server</p>

<ul>
<li>Including secret, persistent volume, persistent volume claim, deployment (persistent volume is a NFS is my case, and the k8s is bare metal, if it even matters)</li>
</ul></li>
<li><p>Some time later, I probably want to upgrade SQL server version, preferable through the CI/CD pipe</p></li>
</ul>

<p>I have tried this out a bit and it work pretty well, but the problem I'm facing is that when I do the deployment, SQL Server creates some sys-DB:s containing the SA password based on the initial secret.</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.name }}-secret
type: Opaque
data:
  sapassword: {{ randAlphaNum 64 | b64enc | quote }}
</code></pre>

<p>Now let's say I want to redeploy or do a version upgrade (or even a power failure, corrupt nodes or whatever else), <br/> the sys-DB:s are mapped to a persistent storage and will be remapped.</p>

<p>However, the SA password "x" is inside the remapped sys-DB is and the newly generated secret SA password is is "y". Is it different for users/consumer-pods passwords (connection strings for Code First generated DBs)?</p>

<p>Any ideas? Or should I simply not generate the passwords in a DB secret?</p>

Henkolicious
<p>I have been in your shoes and ended up removing the secret from the helm chart and made changes in the deployment to inject secrets as a env variable from a k8s secret which I created outside of the helm chart.</p>

<p>Other option I could think is to use external secret managers to dynamically inject secrets to the pod at runtime -> <a href="https://banzaicloud.com/blog/inject-secrets-into-pods-vault/" rel="nofollow noreferrer">https://banzaicloud.com/blog/inject-secrets-into-pods-vault/</a></p>
