Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(db-sync): Vault's database secrets engine #70

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

Conversation

nrdxp
Copy link
Contributor

@nrdxp nrdxp commented Feb 28, 2023

Adds support to retrieve credentials dynamically from Vault's database secrets engine, assuming the user has enabled and configured it. There is also a new function which renews the credentials lease every two minutes to avoid a situation where the credentials eventually expire.

This change also maintains the legacy path as well.

The link is still private for many, but a real world example of how to configure this nicely in terraform lives here.

@nrdxp nrdxp marked this pull request as draft February 28, 2023 01:29
@nrdxp nrdxp marked this pull request as ready for review February 28, 2023 01:49
@nrdxp nrdxp marked this pull request as draft February 28, 2023 22:57
@nrdxp
Copy link
Contributor Author

nrdxp commented Feb 28, 2023

Converting to draft since I just hit hashicorp/nomad#15714

We may just have to renew the lease ourselves after all. Reopened with lease renewal accounted for in the entrypoint.

@nrdxp nrdxp marked this pull request as ready for review March 1, 2023 18:10
@nrdxp nrdxp force-pushed the db-sync-vault branch 6 times, most recently from 43de833 to 7726ede Compare March 1, 2023 21:18
Add an additional function to the loop which renews the lease every two
minutes if the credentials are detected to be from Vault's DB backend.
@nrdxp nrdxp force-pushed the db-sync-vault branch 2 times, most recently from c90a6f3 to 65b0e06 Compare March 5, 2023 17:23
@nrdxp nrdxp requested a review from a team as a code owner March 5, 2023 17:23
@nrdxp nrdxp force-pushed the db-sync-vault branch 5 times, most recently from b517440 to 01076b4 Compare March 7, 2023 06:53
@nrdxp nrdxp requested a review from johnalotoski March 7, 2023 14:08
@nrdxp
Copy link
Contributor Author

nrdxp commented Mar 7, 2023

Okay this is finally ready, working and tested. When a credentials lease hits its max ttl and can no longer be extended the entrypoint will now stop the background db-sync process, grab brand new credentials, and then restart the background db-sync, allowing the job to run indefinitely.

Also I added a snippet to exit entirely if db-sync stops unexepectedly, since it has happened before and causes and outage, where now Nomad will simply reschedule and allow the work to continue.

@nrdxp nrdxp marked this pull request as draft March 22, 2023 18:22
@nrdxp
Copy link
Contributor Author

nrdxp commented Mar 22, 2023

I found out today that with more appropriate SQL creation statements, we can avoid having to manage the lease manually at all, so I can simplify this PR quite a bit before merging, putting in draft til then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant