# Runbook: rotating the orders database password

Kestrel Logistics platform team. Owner: platform on-call. Last reviewed October 2, 2026.

*Kestrel Logistics and its systems are fictional. This sample document was written for pdfconversionapi.com and is released under CC0 1.0.*

## When to use this runbook

The orders-app database role gets a new password **every 90 days**. Rotate it early in any of these

cases:

• Someone with production database access leaves the company.

• The password shows up in a log, a ticket or a chat message.

• Security asks for it during an incident.

## Before you start

1\. Announce the rotation in the *\#platform-changes* channel.

2\. Check that replication lag on the read replicas is under 5 seconds.

3\. Confirm you hold the db-admin role in Vault.

## Steps

## 1. Issue the new password

vault write -f database/rotate-role/orders-app

## 2. Restart the API so it reads the new secret

kubectl -n orders rollout restart deployment/orders-api

Pods pick up the new password as they restart. The old one keeps working for 15 minutes, which covers a normal rollout.

## Checks

**Check**

**Where**

**Expected**

---

| Pods ready | kubectl -n orders get pods | All 6 Running |
| --- | --- | --- |
| Login errors | Dashboard "Orders DB auth" | 0 after 10 minutes |
| Checkout test | Synthetic check "place-order" | Passing |

## Rollback

If login errors keep climbing after 10 minutes, restore the previous secret version with vault kv

rollback and restart the API again. Full details are on the orders database wiki page.