Based on latest changes in fabric8-auth: the /api/status endpoints checks expected configuration and expose configuration errors to status result. So if there is something wrong with CM or secret in prod then the new deployment will fail and the old one will keep working.
cc: @alexeykazakov