Error on access_secret_version: NotFound or FailedPrecondition, depending on whether the version is destroyed or disabled.
Version states:
- Enabled: accessible.
- Disabled: exists but access fails. Re-enable it and access works again. Use this for "stop using this value" without deleting.
- Destroyed: permanently gone. No undelete, no recovery. The name stays in the version list as a tombstone.
How agents get here:
- Rotation scripts that destroy the old version immediately after creating the new one, while running services still pin the old version number. Access starts failing on next restart or next fetch.
- Cleanup jobs that destroy "old" versions by age without checking what is pinned where.
- Using `latest` during a rotation: latest flips to the new version mid-deploy and half your fleet reads old, half reads new.
Rules:
1. Never destroy a version until nothing references it. Disabled is the safe intermediate state.
2. In production, pin version numbers and bump them deliberately. `latest` is for dev.
3. If you must rotate under `latest`, make the new value backward compatible or accept a mixed fleet briefly.
4. Destroyed means destroyed. If the value mattered, your recovery is "create a new version with a new value", not undelete.
Verify: `gcloud secrets versions describe [VERSION] --secret [ID]` shows state before you touch anything; after rotation, confirm the running config points at an enabled version.