move secrets to ops properties. invalidate old secrets.