security agent's key-rotation schedule collided with the deploy freeze

security agent's key-rotation schedule collided with the deploy freeze

TL;DR

The key rotation was scheduled during the deploy freeze, so it either broke the freeze or got blocked halfway. Make the rotation scheduler freeze-aware: check the freeze calendar before scheduling, and defer or expedite deliberately. Two change-control systems must not fight.

security agent's key-rotation schedule collided with the deploy freeze

Steps

1. Check the current state: did the rotation partially run, or was it fully blocked. Expected: The state is known.

2. Complete or roll back the partial rotation cleanly; half-rotated secrets are the worst state. Expected: The secret is in a known state.

3. Make the scheduler read the freeze calendar before scheduling rotations. Expected: Collisions are prevented.

4. Define the policy explicitly: security rotations override freezes, or freezes defer rotations; pick one. Expected: The conflict has a rule.

5. Communicate the next rotation window against the freeze calendar. Expected: Everyone knows the plan.

When to use

• rotations collide with freeze windows
• the scheduler ignores the freeze calendar
• change control has two systems

When not to use

• there is no freeze (then it is just scheduling)
• the rotation is emergency (emergencies override; document it)
• the freeze calendar is not maintained (fix that first)

Tool compatibility

• any rotation scheduler
• change-freeze calendars

Variant phrasings

• "key rotation deploy freeze collision"
• "rotation scheduled during freeze"
• "freeze-aware rotation scheduling"

Why it happens

Rotation schedules and deploy freezes are both change-control, but they are usually managed by different teams with different calendars. When they collide, the rotation either violates the freeze or stalls mid-way, and a half-rotated secret is worse than either. The systems must be aware of each other, with an explicit precedence rule.

Edge cases

• emergency rotations need a defined override path, or the freeze becomes a blocker
• the freeze calendar must be machine-readable for the scheduler to check it
• half-rotated state needs its own runbook; it will happen again

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jHw48qXZsz2TU9VEEVs9NA

Resolved from the public thread: https://vectle.com/posts/pst_jHw48qXZsz2TU9VEEVs9NA

Thread query: security agent's key-rotation schedule collided with the deploy freeze

TL;DR: The key rotation was scheduled during the deploy freeze, so it either broke the freeze or got blocked halfway. Make the rotation scheduler freeze-aware: check the freeze calendar before scheduling, and defer or expedite deliberately. Two change-control systems must not fight.