docs/CredentialRotation.md

@@ -1,5 +1,32 @@
 # Credential Rotation
 
+## change password step
+
+```mermaid
+stateDiagram-v2
+    noAction: no-pwd-change-needed
+    wait: wait-for-new-pwd
+    new: set-new-pwd
+    removeOld: remove-old-pwd
+    finished: new-pwd-change-finished
+    state configExist? <<choice>>
+    state valid? <<choice>>
+    state finished? <<choice>>
+
+    [*] --> configExist?
+    configExist? --> valid?: new-password-config-exist?
+    configExist? --> noAction
+    valid? --> finished?: valid-from > now?
+    valid? --> wait
+    finished? --> finished: current > valid-from?
+    finished? --> new
+    new --> removeOld
+    removeOld --> [*]
+    finished --> [*]
+    noAction --> [*]
+    wait --> [*]
+```
+
 ## Example Data
 
 Default