Credential Rotation

Overview

Gardener deals with two distinct classes of credentials for Shoot clusters. They differ in scope, ownership, and how they are rotated:

• Gardener project secrets - owned and managed by the project owner/admin (Gardener service user). They are used by Gardener service to authenticate to cloud provider APIs and manage cloud resources required for the shoots. Rotation of the project secrets is controlled by the project owner/admin and happens via the Gardener API or via Gardener Dashboard.
• Shoot cluster secrets - created automatically when the shoot cluster is created and used for the cluster processes. Shoot cluster credentials rotation is responsibility of the project owner/admin and is performed for most of the credentials in two steps. You can find more details below.

Gardener Project Secrets (Infrastructure Credentials)

Gardener project secrets are cloud provider keys you supply to Gardener so it can manage your cluster's infrastructure (networks, VMs, disks, load balancers). These keys are stored in a Secret in the garden cluster's project namespace and referenced by your Shoot via a CredentialsBinding. A single Secret can be shared across multiple Shoots.

When you rotate these credentials, you update the Secret with new keys, wait for all Shoots referencing that Secret to reconcile successfully, and only then deactivate the old keys in your cloud provider account.

NOTE

It is not possible to move a Shoot to a different infrastructure account.

Shoot Cluster Credentials Rotation

For Gardener-managed credentials, rotation happens in two phases where possible.

In the Preparing phase, new credentials are created alongside the old ones — both sets are valid simultaneously. This gives you time to update any API clients, kubeconfigs, or tooling that depend on the old credentials before they are invalidated.

In the Completing phase, the old credentials are invalidated and only the new set remains. You should only trigger this phase after all clients have been updated to use the new credentials.

The shoot's status always reflects the current rotation phase, readable at .status.credentials.rotation.

You can also conveniently trigger rotation from the Gardener dashboard:

Automatic Rotation

Some Gardener-managed credential types support automatic rotation during the maintenance window via .spec.maintenance.autoRotation.credentials:

• SSH key pair
• ETCD encryption key (enabled by default on new shoots)
• Observability passwords

Certificate authorities and the ServiceAccount signing key require user action between phases and therefore cannot be rotated automatically.

For configuration details, see Automatic Credentials Rotation.

Additional Details

For step-by-step instructions, go directly to the relevant section in the Credentials Rotation for Shoot Clusters documentation:

• Infrastructure credentials (cloud provider keys)
• Shoot credentials (CAs, SSH, ETCD, etc.)