Swap Kubernetes Secrets Without Application Disruption: Comparative Study and eBPF-Powered Kernel Interception Framework
Abstract
The typical native mechanism in Kubernetes to handle secret rotation, refreshes files roughly every minute, but applications must re-open them or restart to pick up updated credentials. Common workarounds used by top industry players (CSI driver, sidecar, restarts) trade off in terms of latency, complexity, or security. We survey six approaches—native refresh, CSI Secrets Store, Vault Agent sidecar, LD_PRELOAD shim, eBPF interceptor, and pod restart—evaluate each on downtime, security, performance overhead, complexity, and portability. Also highlight on eBPF‐based kernel interceptor that hot-swaps secrets in sub-second latency without pod restarts or app changes. We describe aspects involving its design, implementation, and planned evaluation.
Fields of Study & Subjects
Security and Verification in Computing
Digital and Cyber Forensics
Software System Performance and Reliability
Publication details
- Journal / source
- World Journal of Advanced Engineering Technology and Sciences
- Publisher
- GSC Online Press
- Volume
- 18
- Issue
- 1
- Pages
- 066–070
- Publication date
- 14 January 2026