Introduction Expired secrets in CI/CD pipelines cause sudden deployment failures that are difficult to diagnose. API tokens, Docker registry credentials, cloud provider keys, and SSH certificates all have expiration dates that must be managed.

Symptoms - Pipeline fails with: "unauthorized: authentication required" - Error: "The security token included in the request is expired" - Error: "401 Unauthorized" from artifact registries - SSH deployment key rejected - Pipeline worked yesterday but fails today

Common Causes - Docker registry token expired (default 1 year for GCP, variable for others) - Cloud provider temporary credentials expired (STS tokens) - SSH certificate expired - API key rotation without updating CI/CD secrets - OAuth refresh token revoked or expired

Step-by-Step Fix 1. **Identify which secret is expired**: Check pipeline logs for authentication errors. Common patterns: - Docker: "unauthorized: Token has expired" - AWS: "ExpiredToken: The security token included in the request is expired" - GCP: "Request had invalid authentication credentials"

  1. 1.Update the expired secret:
  2. 2.```bash
  3. 3.# GitHub Actions
  4. 4.gh secret set DOCKER_PASSWORD --body "new-password"
  5. 5.# GitLab CI
  6. 6.gitlab-ci --update-secret EXPIRED_SECRET "new-value"
  7. 7.`
  8. 8.Set up automated credential rotation:
  9. 9.```bash
  10. 10.# For AWS, use IAM roles instead of access keys
  11. 11.# For GCP, use Workload Identity Federation
  12. 12.# For Docker, use credential helpers
  13. 13.`

Prevention - Use short-lived credentials with automated rotation - Monitor secret expiration dates with alerts (30 days before) - Use OIDC-based authentication where possible (no static secrets) - Document all pipeline secrets and their expiration - Implement secret health checks in pipeline pre-flight