secrets-rotation

The YAML describes a plausible secrets-rotation workflow and contains no direct evidence of malware. It creates meaningful security exposure if the container image is compromised or the cluster network is untrusted: the mutable latest image and broad Secret update permissions could enable supply-chain compromise, while HTTP Vault communication could expose credentials. Pin the image by trusted digest, use HTTPS for Vault, restrict RBAC to only required Secrets and verbs where feasible, and review the missing rotation script and image provenance.