Vendors sell Day-1: vault installed, first Safe created, demo applause. Banks pay for Day-2: the next five years of patches, rotations, failovers, and audits — performed on infrastructure where a mistake freezes money movement. This is the maintenance reality nobody demos.

Day-1 vs Day-2

Day-1 (deploy) Day-2 (operate)
Goal First secrets vaulted Every secret vaulted, forever, without incident
Unit of work Safes, Accounts, Platforms onboarded Patches, rotations, recerts, failover drills
Failure mode Project delay Production outage, audit finding
Skill Architecture + automation speed Change discipline + evidence chains

Day-1 rewards speed. Day-2 punishes it. The engineers banks retain are the ones who internalize that asymmetry.

Vault patching and high availability

The vault runs active/passive with a replicated DR copy. The patch cycle that survives contact with auditors:

  1. Snapshot + backup first. If the rollback path doesn’t exist, the change doesn’t start. Verify backup integrity, not just backup existence.
  2. Patch DR first. The passive copy takes the new version while production serves untouched.
  3. Verify database integrity on DR. Vault service up, replication healthy, test checkout through PVWA, test PSM connect — green across the board.
  4. Fail over, then patch the old primary. Planned switchover during the window; production sessions ride the freshly verified node. Zero session disruption is a procedure, not a feature.
  5. Daily proof it holds. System Health showing Primary + DR green every shift is what makes the next failover boring — boring is the goal.

Change-window execution (CPM/PSM)

Component upgrades — CPM rotation engine, PSM session brokers, PVWA front ends — happen off-peak, always. The rule I brief: infrastructure change windows belong off-peak to guarantee zero production impact. CPM rotation schedules get audited against application connection pools before enforcement, because an automated password change that breaks a database pool is an outage wearing an automation costume. terraform plan as the dry-run artifact, apply inside the window, re-verify every object after.

The parallel nobody asked for

I run my blog’s delivery the same way: heavy validation locally where logs are immediate, tiny smoke gates remotely, deploys as explicit acts — never background magic. Bare-metal local execution with pinned toolchains beats pipeline overhead for the same reason DR-first beats patch-and-pray: the blast radius of every step is known before the step runs. Zero-trust control planes, zero-surprise maintenance. Different estates, same discipline.