The rotation adapter catalogue
Every platform Qorionix can rotate automatically, in one table, each pointing at the article with the actual prerequisites, failure modes and what has been tested.
Written for whoever runs IT6 min readUpdated
This is the index, not the detail. Every platform Qorionix can rotate automatically is here, in one table, each pointing at the article that actually covers its prerequisites, its verbatim failure messages, and — honestly — what has and has not been tested against a real instance of it. Read Credential rotation overview first for how a schedule works at all; this article assumes you already know that.
The full catalogue
| Platform | Engine | Detail |
|---|---|---|
| Linux (password) | linux_ssh | Rotating Linux and SSH credentials — proves itself by reconnecting with the new password. |
| Linux (SSH key) | linux_ssh_key | SSH key rotation — new this wave. Proves the new key before removing the old, and reports a partial success rather than an outage if cleanup fails. |
| PostgreSQL | postgres_role | Rotating database credentials — self-verifying, tested against real servers. |
| SQL Server | sqlserver_login | Rotating database credentials — self-verifying, tested against real servers. |
| MySQL / MariaDB | mysql_user | Rotating database credentials — new this wave. A hand-rolled wire-protocol client, no external driver. Supports both mysql_native_password and caching_sha2_password; the fast authentication path works either way, but caching_sha2_password's full-auth path only works over a TLS connection, since it otherwise sends the password in the clear. |
| Oracle | oracle_user | Rotating database credentials — new this wave. Shells out to sqlplus; needs Oracle Instant Client installed on the rotation worker's own machine, and says so clearly if it is missing. |
| AWS IAM access key | aws_iam_key | Rotating cloud credentials — verifies implicitly through its own delete step. |
| AWS RDS IAM token | aws_rds_iam | Rotating cloud credentials — not really a rotation; read why before scheduling it. |
| Microsoft Entra ID service principal | entra_service_principal | Rotating cloud credentials — mock-tested only, no real tenant has run it yet. |
| Azure VM local account | azure_vm_local | Rotating cloud credentials — new this wave. Uses Azure Resource Manager RunCommand, so it works even with no public IP or inbound firewall rule on the VM. Needs a delegate app registration holding the runCommand permission; delegated rotation only, no self-rotation mode. |
| GCP service-account key | gcp_service_account_key | Rotating cloud credentials — new this wave. Create-then-delete, and can self-rotate via a signed JWT if the service account holds roles/iam.serviceAccountKeyAdmin on itself. |
| Cisco IOS / IOS-XE | cisco_ios | Rotating network device credentials — verifies with a fresh SSH login; tested against an emulated CLI, not real hardware. |
| Palo Alto PAN-OS | paloalto_panos | Rotating network device credentials — a device-wide commit; read the warning about that before scheduling it. |
| Juniper Junos | juniper_junos | Rotating network device credentials — new this wave. NETCONF over SSH, edit-config then commit. |
| FortiOS | fortios_admin | Rotating network device credentials — new this wave. REST API; needs a delegate API token, since you cannot change your own password mid-session over a password login. |
| VMware vCenter appliance | vcenter_local_account | Rotating network device credentials — new this wave. Scoped to the appliance's own local accounts such as root, not SSO-domain accounts. |
| Active Directory / Windows | ad_service_account, windows_local | Rotating Active Directory and Windows credentials — the highest-risk group; read before, not after. |
| Anything else | generic (no rotation) | Still gets a vault entry, access control and an audit trail — see The credential vault. Rotate it by hand on a calendar reminder. |
generic_db is a routing adapter rather than a platform of its own — it dispatches to postgres_role, sqlserver_login or mysql_user based on target metadata, and is only reachable by calling the API directly, not from the console. See Rotating database credentials if you need it.
What to do next
- Find your platform in the table and read its article before you enable rotation — each one names the specific thing that breaks on that platform, which this index deliberately does not repeat.
- For a platform new this wave, treat the first rotation as a supervised test on a machine you can afford to break, the same advice every one of the linked articles gives for its own newest engine.