Portainer Server ↔ Docker Engine & Kubernetes API: Credential Rotation Impact on Persistent Connections

The goal is to clarify whether Portainer’s integration boundary automatically renews Docker event streams and Kubernetes watch streams after a rotation of the TLS credentials or kubeconfig used for onboarding, without requiring a manual restart of the server or agent, and to assess any associated memory‑usage implications.

Constraints include version‑specific behavior between Portainer CE/EE and agent releases, variability in polling intervals, and the fact that credentials are stored internally, making it unclear how updates propagate to long‑lived streams. Operational verification relies on inspecting stream reconnect logs and tracking resident memory over extended periods.

• Does Portainer automatically recreate Docker event streams and Kubernetes watch streams when the stored TLS or kubeconfig credentials are rotated?
• If streams are not recreated, what is the expected impact on memory growth in the server and agent processes?
• Are there configuration options or environment variables that control the reconnection interval or force stream renewal after credential changes?