If you run Go services on Kubernetes, you know the ritual. You update a Secret or a ConfigMap, and then you do one of these:kubectl rollout restart deployment/my-app and eat the disruption. Install Reloader so it restarts your pods for you when a Secret changes. Mount the Secret as a volume and cross your fingers that your app re-reads the file (spoiler: most apps read it once at boot).All three share the same flaw: the way you "pick up" a config change is to throw away the process and start a new one. For a rotating database password, that means dropping every in-flight request, cold connection pools, and a latency spike — all to change one string.