But how do you do that without also having a long-lived key or access token to those services?
replyThe long-lived credentials life inside a stripped down machine. Cron/lego/Ansible handles the renewal. The machines on the edge can't renew their keys themselves.
replyOh, this makes sense, so instead of "the app is rotating its keys" is more like "the keys in our app are being rotated by an external service".
reply