Rotate global secrets when credentials change in the built-in cribl store or in an external provider. Update the value at its backing store, then commit and deploy affected Worker Groups and Edge Fleets so that nodes load the updated credential.

Global secrets are supported only in Cribl.Cloud.

Rotate Global Secrets in the Built-in cribl Secret Store ​

To rotate a global secret that is backed by the built-in cribl secret store, update the value directly in Cribl:

1. In Global Settings > Security > Secret Folders, select the secret folder and existing global secret. Manually update the rotated value. You can also update the global secret value using the Cribl API endpoint PATCH /system/secret-folders/{folderId}/secrets/{id}.
2. Review the Git diffs for each affected Worker Group and Edge Fleet, especially global-secrets-marker.yml, and confirm that fingerprints changed only for the global secrets that you intended to rotate.
3. Commit and deploy the changes.

After you deploy, the secrets.yml file in the deployment bundle includes global secrets from secret folders shared with each affected Worker Group or Edge Fleet. Cribl restarts affected processes on nodes so that they load the new credential. The new global secrets are not applied silently to processes that are already running.

For the built-in cribl store, global secret values remain in encrypted values.json on the Leader. You do not need to reload the secret folder.

Rotate Global Secrets in Externally Backed Secret Stores ​

For secret folders that are backed by external secret stores, rotating a global secret value in the external store alone does not update what Cribl serves until you reload the secret folder. A Leader restart loads current values from the external provider without explicit reload, but Worker Groups and Edge Fleets do not receive updated credentials until you commit and deploy.

When you reload a secret folder, Cribl:

1. Re-fetches global secrets in the secret folder from its backing store.
2. Invalidates the Leader’s cached resolution for the folder.
3. Compares content fingerprints to detect rotated references.
4. Persists updated metadata.
5. Refreshes global-secrets-marker.yml for each affected Worker Group and Edge Fleet so that Git diffs show which secrets changed without exposing values for sensitive fields.

Cribl re-fetches only global secrets that are already defined in the secret folder. Reload does not validate new references to external global secrets. Cribl validates those references when you add or update global secrets.

To rotate a global secret in a secret folder with an externally backed secret store:

1. In the external store, update the credential using your normal security process.

2. In Cribl, in Global Settings > Security > Secret Folders, find the secret folder that contains the rotated global secret.

3. In the Actions column for the secret folder, select the ellipses (three dots). Select Reload for the secret folder to fetch the referenced values from the external provider for the rotated global secret.

   • If reload fails or the external provider returns access errors, fix the underlying issue and reload again.

   • You can also reload the secret folder using the Cribl API endpoint POST /system/secret-folders/{id}/reload.

     Reload API requests share a rate limit of 10 requests per minute across all secret folders. If you script bulk reloads, allow time between requests or handle 429 responses using the Retry-After header.

4. Review the Git diffs for each affected Worker Group or Edge Fleet, especially global-secrets-marker.yml, and confirm that fingerprints changed only for the secrets that you intended to rotate.

5. Commit and deploy the changes.

After you deploy, the secrets.yml file in the deployment bundle includes referenced secrets for each affected Worker Group or Edge Fleet. Cribl restarts affected processes on nodes so that they load the new credential. The new global secrets are not applied silently to processes that are already running.