Swap Kubernetes Secrets Without Application Disruption: Comparative Study and eBPF-Powered Kernel Interception Framework

The typical native mechanism in Kubernetes to handle secret rotation, refreshes files roughly every minute, but applications must re-open them or restart to pick up updated credentials. Common workarounds used by top industry players (CSI driver, sidecar, restarts) trade off in terms of latency, complexity, or security. We survey six approaches—native refresh, CSI Secrets Store, Vault Agent sidecar, LD_PRELOAD shim, eBPF interceptor, and pod restart—evaluate each on downtime, security, performance overhead, complexity, and portability. Also highlight on eBPF‐based kernel interceptor that hot-swaps secrets in sub-second latency without pod restarts or app changes. We describe aspects involving its design, implementation, and planned evaluation.