Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance Daemon Mode to Dynamically Regenerate Secrets After Max TTL Expiry #204

Open
2 tasks done
4FunAndProfit opened this issue Oct 22, 2024 · 0 comments
Open
2 tasks done
Labels
kind/enhancement Categorizes issue or PR as related to an improvement.

Comments

@4FunAndProfit
Copy link

4FunAndProfit commented Oct 22, 2024

Preflight Checklist

  • I have searched the issue tracker for an issue that matches the one I want to file, without success.
  • I agree to follow the Code of Conduct.

Problem Description

Issue Description:
In the current daemon mode implementation for vault-env, dynamic secrets are revoked once their max_ttl expires, which causes the renewal process to stop. This limitation can lead to disruptions in services relying on dynamic secrets, such as database credentials, after the max_ttl has been reached.
(See bank-vaults/bank-vaults#856)

Proposed Solution

Would it be possible to enhance the daemon mode to handle this scenario by dynamically regenerating the secrets (e.g., creating new tokens or rotating credentials) when the max_ttl is reached? Alternatively, is there another solution or workaround that can keep the secrets up to date without manual intervention after the max_ttl expires?

Thank you for your help!

Alternatives Considered

A lot but don’t find a correct solution for now 😭😂

Additional Information

No response

@4FunAndProfit 4FunAndProfit added the kind/enhancement Categorizes issue or PR as related to an improvement. label Oct 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement Categorizes issue or PR as related to an improvement.
Projects
None yet
Development

No branches or pull requests

1 participant