The rotation of credential fernet keys would not happen automatically, but there should be a documented way of doing the rotation. This could just be a pointer on how to run keystone-manage with an appropriate image and volume mounts.