Deleted workload secrets stop working across the fleet within five minutes

Deleting a workload’s secret is meant to make that workload permanently undecryptable. Edge nodes can’t decrypt a workload without fetching its secret from the control plane, so once the secret is gone, no node can serve the workload again.

The deletion removed the secret from storage, but the control plane kept a copy of every secret it had loaded in memory, and it didn’t discard them until it restarted. Until then, it kept giving the deleted secret to any edge node that asked.

Loaded secrets now expire from memory after five minutes, so a deletion takes effect across the whole fleet within that time. Removing the secret the moment it is deleted is planned as a follow-up.

This also stops the control plane building up an ever-growing store of secrets in memory.