A computer system comprising: one or more hardware processors and memory configured to provide computer program instructions to the one or more hardware processors; a secrets management service ("SMS") configured to utilize the one or more hardware processors to: receive a specified secret for a deployed service and a rollover policy for the specified secret; install the specified secret in a first secrets store of the SMS; provide the specified secret, by the SMS, to facilitate an initial deployment of the deployed service to an agent on a node in a distributed computing environment, the initial deployment installing the specified secret in a second secrets store of the node; automatically renew the specified secret in the first secrets store, by the SMS, pursuant to the specified rollover policy; and in response to receiving a periodic polling request from a credentials management component associated with the agent, release the renewed secret to the credentials management component; wherein the secret management service is further configured to track, with the SMS, an internal state of the agent, wherein the tracking comprises: setting a first state of the agent indicating delivery of the renewed secret to the agent, in response to delivering the renewed secret to the agent; and setting a second state of the agent indicating the delivery is confirmed, in response to receiving, in a subsequent periodic polling request, metadata indicating the renewed secret is installed in the second secrets store of the node. one or more hardware processors and memory configured to provide computer program instructions to the one or more hardware processors; a secrets management service ("SMS") configured to utilize the one or more hardware processors to: receive a specified secret for a deployed service and a rollover policy for the specified secret; install the specified secret in a first secrets store of the SMS; provide the specified secret, by the SMS, to facilitate an initial deployment of the deployed service to an agent on a node in a distributed computing environment, the initial deployment installing the specified secret in a second secrets store of the node; automatically renew the specified secret in the first secrets store, by the SMS, pursuant to the specified rollover policy; and in response to receiving a periodic polling request from a credentials management component associated with the agent, release the renewed secret to the credentials management component; wherein the secret management service is further configured to track, with the SMS, an internal state of the agent, wherein the tracking comprises: setting a first state of the agent indicating delivery of the renewed secret to the agent, in response to delivering the renewed secret to the agent; and setting a second state of the agent indicating the delivery is confirmed, in response to receiving, in a subsequent periodic polling request, metadata indicating the renewed secret is installed in the second secrets store of the node. receive a specified secret for a deployed service and a rollover policy for the specified secret; install the specified secret in a first secrets store of the SMS; provide the specified secret, by the SMS, to facilitate an initial deployment of the deployed service to an agent on a node in a distributed computing environment, the initial deployment installing the specified secret in a second secrets store of the node; automatically renew the specified secret in the first secrets store, by the SMS, pursuant to the specified rollover policy; and in response to receiving a periodic polling request from a credentials management component associated with the agent, release the renewed secret to the credentials management component; wherein the secret management service is further configured to track, with the SMS, an internal state of the agent, wherein the tracking comprises: setting a first state of the agent indicating delivery of the renewed secret to the agent, in response to delivering the renewed secret to the agent; and setting a second state of the agent indicating the delivery is confirmed, in response to receiving, in a subsequent periodic polling request, metadata indicating the renewed secret is installed in the second secrets store of the node. setting a first state of the agent indicating delivery of the renewed secret to the agent, in response to delivering the renewed secret to the agent; and setting a second state of the agent indicating the delivery is confirmed, in response to receiving, in a subsequent periodic polling request, metadata indicating the renewed secret is installed in the second secrets store of the node.