A module is adopted with the credentials it already has

Nothing is rotated during the conversion. A service keeps the password it is already using, because minting a new one is how a running service stops being able to reach its own database mid-migration. The mesh has both paths already: generate-and-seal for a new module, accept-and-seal for an adopted one. Adoption needs the second, and it is built. Rotation becomes a separate act afterwards, once everything works — the machinery is proven, and it is a thing to do deliberately rather than as a side effect of moving a service between systems. Records the step that has to come first and is easy to miss: read the current environment out of the old system while it can still be read. Once accepted, the mesh cannot show a secret back, and once the old system is gone neither can that. A password nobody wrote down is a service nobody can adopt.
2026-08-31 21:31:26 +02:00
parent f801b4b3e2
commit b68103d198
1 changed files with 23 additions and 0 deletions
@@ -133,6 +133,29 @@ nothing about a disk, a mistaken command, or a service corrupting its own store.
 through the service that owns it, and only then does anything point at the new location. Never
 moved and then checked. **A backup nobody has restored is a belief, not a copy.**

+## A module is adopted with the credentials it already has
+
+*2026-08-31.* **Nothing is rotated during the conversion.** A service being adopted keeps the
+password it is already using, because minting a new one is how a running service stops being able
+to reach its own database in the middle of a migration.
+
+The mesh has both paths and this needs the second:
+
+| | |
+|---|---|
+| **generate** | a new secret, sealed to both ends. What a *new* module gets |
+| **accept** | a value supplied from outside, sealed, plaintext discarded. **What an adopted module gets** |
+
+**Rotation is a separate act, afterwards, once everything works.** The machinery for it is built
+and proven — a credential moving at both ends with the old one ceasing to work — and it is exactly
+the sort of thing to do deliberately on a quiet afternoon rather than as a side effect of moving a
+service between systems.
+
+**So there is a step before any of this: read the current environment out of the old system while
+it can still be read.** Once a value is accepted, the mesh cannot show it back — *a mesh that can
+reveal a secret is a mesh that holds it* — and once the old system is gone, neither can that. A
+password nobody wrote down is a service nobody can adopt.
+
 ## Where it starts, and what that costs

 **On the node holding all the production data**, because that is where the services being