-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Templates with vault database credentials don't re-render using a grace period #2922
Comments
@deweller Is the ask to essentially expose the vault grace period in the config? |
Yes. I'm requesting 2 things:
Thanks. |
@deweller Thanks for clarifying and for posting the issue! We are on the same page now. Just so you are aware, the default grace is actually 5s: https://github.com/hashicorp/consul-template/blob/master/config/vault.go#L14 |
Great. Thanks. BTW, I think that was intended to be 5 minutes. |
This PR allows a template to specify the Vault grace duration. Fixes #2922
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
Nomad v0.5.6
Operating system and Environment details
Ubuntu Linux 16.04
Issue
I'm using a template to pull dynamic database credentials from Vault. When database credentials are rotated with Vault, there is a brief time while the app has stale database credentials. The credentials rotate in Vault as they should, but the app receives the updated credentials with no grace period. Therefore the app is working with stale credentials while the template re-renders.
Is possible to use the grace period in consul-template so the credentials are rotated a few minutes before the
max_ttl
expires on the database credentials?Standard secrets reload at half of their lease, but the database credentials do not do this.
Reproduction steps
I created a new database role with a
max_ttl
of 1h. The database credentials are rotated and the template is re-rendered every hour and not every 30 minutes as expected.My template data includes something like this:
Here is a sample of the nomad logs:
You can see that the template is re-rendered once per hour. I would expect the template to be re-render once every 30 minutes, or once every 55 minutes (with a 5 minute grace period).
The text was updated successfully, but these errors were encountered: