My home Kubernetes cluster used to run on long-lived keys, copied into more places than I could list. Part one: the idea that replaced them, and how the cluster now pulls its images as the pod that needs them, without a stored credential.
Kafka's log is immutable and replicated everywhere; GDPR demands you make a user's data unreachable on request. Per-user DEKs in Postgres, an Avro envelope on the wire, and crypto-shredding gets you both — without ever mutating Kafka.
