Elasticsearch Hot Reload Credentials Migration

Set up hot-reloading Elasticsearch managed credentials on a BEDEV2 service (C#, Go, or Python) so creds rotate from Vault with no service restart — both migrating an existing service off static credentials and standing up a brand-new (greenfield) service with hot-reload from the start. C# services adopt Roblox.RobloxElasticsearchClient 2.0.0, which is generic over the client type and works with ANY Elasticsearch client — ES7 (NEST/Elasticsearch.Net) or ES8 (Elastic.Clients.Elasticsearch) — by supplying a ~15-line client builder; Go services on go-elasticsearch (v7 or v8) adopt the eshotreload library (NewStore + eshv7/eshv8 NewClient); Python services on elasticsearch-py (v7 or v8) adopt the roblox-eshotreload library (new_started_store + eshotreload.es7/es8 new_client). Use when a service constructs its own Elasticsearch client (new ElasticsearchClient(...), ElasticsearchClientSettings, BasicAuthentication, ElasticsearchClientFactory in C#; elasticsearch.NewClient with Username/Password/APIKey in Go; Elasticsearch(basic_auth=..., api_key=...) or connection_class with static auth in Python), reads ES creds from env vars / appsettings / config (ElasticSearchUsername, ElasticSearchPassword, ElasticsearchClientSettings__*, ELASTIC_CLIENT_USER_*, ES_USERNAME/ES_PASSWORD, ES_API_KEY), needs to adopt managed credentials / managed_secrets.json, set meta.EnableManagedCredentials, stop restarting on credential rotation, or is asked to move to hot-reloading / rotating Elasticsearch credentials. Also use when a new or greenfield service needs to add an Elasticsearch client with rotating/hot-reload credentials, or a service already has an ES client but no managed-credentials wiring yet. Also covers eshotreload, http.RoundTripper-based credential injection (Go), the elastic_transport Node / elasticsearch.connection subclass injection (Python), and the ccgen managed_secrets.json schema. As of library 2.0.0 there is NO client-version gate in C#: NEST (Nest, IElasticClient) and Elasticsearch.Net (IElasticLowLevelClient) services adopt hot-reload directly via their own builder — no v7→v8 rewrite required first (a v7→v8 client migration is a separate, optional concern for ES9 readiness, not a prerequisite for credential hot-reload). Go and Python have no such gate either — v7 and v8 wrappers ship side by side.

mkdir -p ~/.claude/skills/elasticsearch-hot-reload-credentials-migration
curl -L https://claudskills.com/skills/elasticsearch-hot-reload-credentials-migration/SKILL.md \
  -o ~/.claude/skills/elasticsearch-hot-reload-credentials-migration/SKILL.md

@misc{elasticsearch-hot-reload-credentials-migration-2026,
  author    = {druhinb},
  title     = {Elasticsearch Hot Reload Credentials Migration [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/elasticsearch-hot-reload-credentials-migration/}
}