Versions, and how a secret changes without breaking anything¶
Changing a credential is never instantaneous: for a moment, the old one is still in use somewhere while the new one is being written down. A system that treats the change as instantaneous breaks something at 3 a.m. So secrets here keep a version history and move through defined states.
State
Meaning
Can consumers use it?
pending
Written, not yet published
No
current
The one you get by default
Yes
previous
Just replaced, inside its grace period
Yes, deliberately
retired
Grace expired
Only if asked for by version number
upstream-revoked
The credential no longer works anywhere
No, kept for the record
During the grace period (24 hours by default) both the current and previous values are readable, so a service that cached the old one keeps running while everything catches up.