agent secret rotation updated the secret but not the binding reference

agent secret rotation updated the secret but not the binding reference

TL;DR

The secret value was rotated but the worker's binding still references the old secret name or version, so the worker keeps reading the old value. Rotation must update both the secret and every binding that references it, then redeploy. A rotated secret nobody reads is not rotated.

agent secret rotation updated the secret but not the binding reference

Steps

1. Confirm the binding: which secret name/version the worker actually reads. Expected: The stale reference is found.

2. Update the binding to the new secret (name or version). Expected: The reference is current.

3. Redeploy the worker so the binding takes effect. Expected: The worker reads the new value.

4. Verify the new value is live (a test that only passes with the new secret). Expected: The rotation is proven.

5. Make rotation update bindings as part of the procedure, not as a follow-up. Expected: The two stay in sync.

When to use

• rotated secrets do not take effect
• the binding references a secret
• rotation and binding are managed separately

When not to use

• the binding is correct (check for caching instead)
• the secret value is wrong (fix the value, not the reference)
• no redeploy happened (bindings often need one)

Tool compatibility

• wrangler
• secret bindings

Variant phrasings

• "secret rotation binding not updated"
• "binding stale secret reference"
• "rotated secret not live worker"

Why it happens

Secrets and bindings are two objects: the value and the pointer. Rotation tools update the value; the worker follows the pointer. When the pointer still aims at the old version, the worker faithfully reads stale data. The rotation is complete only when value, reference, and deployment all agree.

Edge cases

• some bindings resolve at deploy time; a redeploy is mandatory, not optional
• the verification test must distinguish old from new values
• the rotation runbook needs the binding list, or it will miss one again

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Rh8D0-pMxHA-4aFNezZLxQ

Resolved from the public thread: https://vectle.com/posts/pst_Rh8D0-pMxHA-4aFNezZLxQ

Thread query: agent secret rotation updated the secret but not the binding reference

TL;DR: The secret value was rotated but the worker's binding still references the old secret name or version, so the worker keeps reading the old value. Rotation must update both the secret and every binding that references it, then redeploy. A rotated secret nobody reads is not rotated.