hashicorp / vault-plugin-secrets-azure

Vault Azure Secrets plugin
Mozilla Public License 2.0
26 stars 19 forks source link

fix: only run periodic func on active instance in primary cluster or local mount #150

Closed austingebauer closed 1 year ago

austingebauer commented 1 year ago

Overview

This PR adds a condition to the periodic func that ensures it only runs on the active instance in a primary cluster or on local mounts. This fixes an issue where root credential rotation was taking place on the active/secondary and active/primary. This caused intermittent 401s due to the rotations racing and invalidating the credentials of each other's cached clients.

Testing

I was able to reproduce this by getting the timing right on the active/secondary's periodicFunc such that it would perform the rotation. This also resulted in a "cannot write to readonly storage" error within the periodic func (see image below).

Screenshot 2023-07-03 at 5 36 12 PM