skip to content

Configuration & Secret Delivery

How a setting or a credential reaches a running workload: inherited in its environment, mounted as files, or fetched by the process itself. It is where credentials leak and changes never arrive.

on this pageshow

questions

19

The mounted configuration file changed minutes ago, yet the service still enforces the old rate limit — why?

level: juniorimportance: must knowfreq 66%

answer

  1. two events, not one
  2. the value at rest versus the running copy
  3. read once at start-up
  4. parsed into memory, then never revisited
  5. re-read, watch, or replace

basics

~20 s

Delivery and consumption are separate events. The process parsed the file once at start-up and serves from that in-memory copy; nothing re-reads it unless the process was written to, so the old value stands until it re-reads or is replaced.

solid answer

~50 s

Changing a delivered value and a running process using it are two different events, and only the first one happened. The platform made new bytes visible at the mount path; that is where its job ends. The process opened that file once during start-up, parsed it into whatever structure the request path actually consults, and has not looked at the path since — so every request is still evaluated against the copy in memory. Three things can close the gap: the process can re-read on a reload signal, it can watch the mounted file and re-read when it changes, or the instance can be replaced so a new process reads the current bytes at start-up. If the process has none of the first two, replacement is the only path, and until then the old value is simply what the service enforces.

go deeper

for a junior

Recall that a service reads its configuration when it starts and keeps that copy. Changing the delivered value is one step; making the process read again is a second one that has to be arranged.

for a middle

Explain why holding a parsed copy is the sane default — parsing cost, derived structures, coherent evaluation — and name the three ways the new value can take effect, with what each one costs.

for a senior

Show the diagnosis order: bytes on the instance, whether a re-read path exists, whether it re-read and rejected, and whether every replica is in the same state. Be explicit that one restarted instance proves nothing about the fleet.

for a principal

Frame it as a policy question: which settings are worth supporting a reload path for, and which are cheaper to change by replacing instances. Supporting reload is code your team owns and tests forever.

## An edit and an effect are two events When someone says "I changed the config and nothing happened", the change has almost always passed through only the first of two independent steps. 1. **The value at rest changes.** Someone edits the delivered set — here, the rate-limit table the chat gateway reads — and the platform makes the new bytes available to the instances that reference it, at the path where they are mounted. 2. **The process consumes the new value.** Something inside the running process opens that path again, parses it, checks it, and swaps the parsed result into the structure that the request path reads on every call. The platform owns step one. Making new bytes visible does not reach inside a running process and change a value it is already holding — there is no mechanism by which it could, because the process may have turned those bytes into compiled rules, buckets, pools or lookup tables that only it understands. ## Why a process is holding a copy at all Holding a parsed copy is not laziness; it is the normal and usually correct design: - **Parsing costs.** Opening and parsing a file on every request would put filesystem work on the hot path of a service that answers thousands of requests a second. - **Values get transformed.** A rate-limit table becomes counters, windows and compiled matchers. The live structure is derived from the file, not the file itself. - **Coherence matters.** A request should be judged against one complete table. A process that re-read field by field could evaluate half of a request against the old limits and half against the new. - **Most configuration layers bind once.** Whatever loads settings at start-up typically reads them into immutable objects. Nothing in that path subscribes to the file. So the default behaviour of a well-written service is exactly the behaviour that produces this page: the edit is real, the delivered bytes are current, and the running copy is stale. ## The three ways the new value takes effect | Path | What triggers the read | What it costs | Where it fails | |---|---|---|---| | Re-read on a reload signal | Something external tells the process to reload | Cheap; keeps connections and warm state | Nothing sends the signal, or the handler only reloads part of the state | | Watching the mounted file | The process notices the delivered content changed | Cheap; no external step at all | The watcher misses a whole-set swap, or dies quietly and never updates again | | Replacing the instance | A new process starts and reads at start-up | Expensive: restart cost, lost warm state, dropped long-lived connections | Nothing in the declared workload changed, so the platform has no reason to replace anything | The third row is the one that surprises people: editing the delivered values alone usually leaves the declared workload identical, so a platform that keeps the declared shape running sees nothing to do. ## Reading the symptom in order 1. **Check the bytes on the instance itself**, not the source you edited. If the mount still holds the old content, this is a delivery problem and the process is blameless. 2. **Check whether the process has any re-read path.** Look for a reload entry in its logs or a documented signal. If neither exists, no amount of waiting will help. 3. **Check whether it re-read and rejected.** A process that re-reads, fails to parse and keeps the previous table is a very different bug from one that never looked. 4. **Check more than one replica.** One instance that was recreated for an unrelated reason will be on the new table while the rest are not, which produces inconsistent answers rather than uniformly old ones. ## What this is not - It is not proof that the delivery shape is broken. Whether the delivered copy can change under a live process at all depends on which shape it arrived in; that is a separate question from whether the process re-reads. - It is not a change to the declared workload. Editing values and editing the spec that describes the workload are different edits against different objects. - It is not solved by restarting one instance to "confirm the fix". That confirms only that a fresh process reads the current bytes, which was never in doubt. The useful mental model is a cache with no invalidation: the process cached the configuration at start-up, and every propagation mechanism that exists is just a different answer to the question of who invalidates it.

  • The mounted file on the instance still shows the old content. What does that change about the diagnosis?
    It moves the problem back one step: the process is behaving correctly and the delivered value never arrived. Look at whether the instance references the value set you edited, whether the edit was applied where the instance reads from, and whether the projection onto that instance has refreshed yet. Nothing the process does can help until the bytes under the mount are the new ones.
  • The service logs a reload and still enforces the old limit. What is the likely bug?
    The process re-read the file but did not fully adopt it. Common causes: the new content failed validation and the handler kept the previous table, only part of the derived state was rebuilt, or the request path holds its own reference captured at start-up that the reload never replaces. The fix is to build a complete candidate, validate it, then swap the single reference the request path reads.

A printed price list handed to the cashier at the start of the shift. Updating the master copy in the office is real and immediate, and the cashier still charges yesterday's prices until someone hands them the new sheet.

saying these in an interview costs you the question

  • Assumes any updated file is picked up automatically by the process
  • Says the platform pushes new values into a running process
  • Blames the delivery mechanism when the process simply never re-reads
  • Treats one restarted replica as proof the whole fleet updated
  • Calls the change 'not applied' without looking at the bytes on the instance
open as a page

The same report-renderer image runs in an integration environment and in production — what may legitimately differ between the two?

level: juniorimportance: must knowfreq 65%

basics

~20 s

Only the values supplied around the artifact may differ: endpoints, credentials, copy count, verbosity, feature switches. The image bytes stay identical, because identical bytes are what makes an earlier environment's test evidence mean anything in production.

open as a page

If a payments ledger's datastore password is baked into the image it ships as, who can read it and what does changing it cost?

level: juniorimportance: must knowfreq 68%

basics

~20 s

Everyone who can obtain the artifact holds the credential, because the value travels with the image to every registry, mirror, host and environment it reaches. Changing it means building a new artifact and rolling it out, so rotation becomes a release.

open as a page

How does a tuning value reach a process running inside a container, and what does the delivery shape decide?

level: juniorimportance: must knowfreq 72%

basics

~20 s

Two shapes: a flat set of name-value pairs the process inherits when it is created, or a directory of files mounted into its filesystem. The choice decides who else can read the value and what changing it costs.

open as a page

A service can re-read its configuration on a reload signal or by watching the mounted file — how does each fail?

level: middleimportance: must knowfreq 52%

basics

~20 s

Reload on a signal fails when nothing sends the signal to every instance, or the handler rebuilds only part of the state. Watching the file fails when the watcher misses a whole-directory swap, storms on repeated events, or dies silently and never updates again.

open as a page

Your team rebuilds the renderer image for each environment from the same commit — what does a passing staging test then prove?

level: middleimportance: must knowfreq 60%

basics

~20 s

It proves that staging's build of that commit passed. It says nothing checkable about production's build, because the second build resolves its dependencies, base contents and any compiled-in values again, so production runs bytes no test ever touched.

open as a page

What changes about who can read a credential when a workload fetches it itself at run time instead of receiving it injected at start-up?

level: middleimportance: must knowfreq 58%

basics

~20 s

Fetching moves the value out of the workload's delivery description entirely: it exists in the process's memory from the moment it is fetched, so it can be short-lived and renewed. Injection puts a static value into the instance for the instance's whole life.

open as a page

Who else can read a value placed in a container's inherited environment, and what does a mounted file change about that?

level: middleimportance: must knowfreq 66%

basics

~20 s

Every child process the workload starts, anyone allowed to inspect the running workload, and anything that captures process memory or dumps the set into a log. A mounted file narrows that to whoever can reach the path with the right identity.

open as a page

Why does changing an inherited environment value require a new process, while a mounted config file can change underneath one?

level: juniorimportance: should knowfreq 58%

basics

~20 s

An inherited name-value set is copied into the process when it is created, and nothing outside the process can edit that copy, so only a new process sees a new value. A mounted file's bytes live outside the process and can be replaced under it.

open as a page

Editing the delivered value set leaves the workload spec unchanged — how does folding a checksum of the values into that spec force a replacement?

level: middleimportance: should knowfreq 44%

basics

~20 s

A control loop replaces instances only when their declared shape differs from what is running. Putting a checksum of the delivered values into a field of that declared shape makes a value edit change the spec, so the loop sees a difference and replaces the instances.

open as a page

When one unchanged image starts in staging and in production, what decides which set of values it comes up with?

level: middleimportance: should knowfreq 55%

basics

~20 s

The deployment decides, because it is the only party that knows where it is deploying. It either hands the workload a stage name that selects a named set, or hands it a set already merged from shared defaults plus that stage's overrides, resolved once at start-up.

open as a page

Why can a large structured allowlist document not simply be delivered as one more inherited environment variable?

level: middleimportance: should knowfreq 44%

basics

~20 s

A variable's value is one flat string, so a nested, commented document has to be encoded into a single line, and the whole inherited block has a size ceiling. The document loses its structure, its reviewability and its validation.

open as a page

Forty long-lived replicas of a chat gateway serve two different versions of an edited rate-limit table — how do you detect and bound that split?

level: seniorimportance: should knowfreq 38%

basics

~20 s

Make each replica publish a checksum of the value set it actually adopted and the time it adopted it, then alert when more than one version is live beyond the expected window. Bound the split by designing the edit so both versions are simultaneously acceptable.

open as a page

One image, two environments: production fails at start-up on a configuration value staging has had for weeks — how did that happen?

level: seniorimportance: should knowfreq 45%

basics

~20 s

The value sets are maintained per environment, so a key added where it was first needed never travelled to the others. Nothing declared the key set as a contract, so the gap stayed invisible until the code path that reads it ran somewhere nobody supplied it.

open as a page

After the source rotates a ledger's datastore credential, which copies of the old value are still in use, and what makes the cutover survivable?

level: seniorimportance: should knowfreq 47%

basics

~20 s

Rotating at the source only changes what it hands out next; every copy already read by a running process still holds the old value. The cutover survives when the verifier accepts old and new together for a bounded window, so holders can converge in any order.

open as a page

What does giving a workload a short-lived credential buy over storing one long-lived credential and delivering it carefully?

level: seniorimportance: should knowfreq 41%

basics

~20 s

A short validity bounds how long a leaked copy is useful, independently of how fast anyone notices. It also makes rotation continuous, so the path is exercised constantly instead of being an event nobody has rehearsed.

open as a page

A workload moved to a non-root user now fails at start-up reading its mounted config file — what about the delivery shape explains it?

level: seniorimportance: should knowfreq 34%

basics

~20 s

A mounted file has an owner and a mode, so reading it is a permission check. The projected tree was created owned by an identity the workload no longer runs as, and a restrictive mode then denies the open. An inherited variable carries no permissions at all.

open as a page

After a delivered value set changes, what does a process watching its mounted file actually observe, and when?

level: middleimportance: nice to knowfreq 30%

basics

~20 s

It observes the whole new set appearing at once, not a file being rewritten byte by byte, because the platform builds the content elsewhere and swaps the directory pointer in one step. It observes it after a bounded delay, not immediately.

open as a page

A team bundles every environment's settings inside the image and picks one at start-up by stage name — what does that cost?

level: middleimportance: nice to knowfreq 30%

basics

~20 s

Every value change becomes a rebuild, because the values live in the bytes. It also ships every environment's settings to everyone who can pull the artifact, and adding an environment needs a new build — the coupling that one-artifact delivery was meant to break.

open as a page