# keyload

> Go library that reloads TLS certificates, keys and CA bundles at runtime, and keeps the last good material when a reload is bad.

- URL: https://rossedman.io/projects/keyload/

`keyload` reloads your TLS certificate, key and CA bundles from disk while a Go server or client keeps running. When cert-manager rotates a Secret, the next handshake uses the new files. No restart and no reloader sidecar.

- **Both directions.** Your certificate and key, and the CA bundles used to verify servers and clients, so mTLS follows a rotation on both sides.
- **Never applies bad material.** An expired certificate, a mismatched key or a half-written file is rejected, and the last good one keeps serving.
- **Kubernetes Secret volumes** work out of the box, including the `..data` symlink swap.
- **CA rotation without an outage**, with an overlap window that keeps removed CAs trusted for a while.
- **Prometheus metrics and reload events**, standard library only, with a separate `grpccreds` module for grpc-go.

The [docs site](https://rossedman.github.io/keyload/) has an interactive simulator for pushing good and bad files at a reloader.