search

hashicorp / vault-rails

A Rails plugin for easily integrating Vault secrets
Mozilla Public License 2.0
339 stars 53 forks source link

Use vault-ruby 0.17.0 to add automatic retry on 412 errors #119

Closed digivava closed 2 years ago

digivava commented 2 years ago

Description

The vault-ruby gem now has the ability to retry on 412 errors (caused by a mismatch between the WAL index on a standby node and the token; see Server-Side Consistent Tokens FAQ).

This PR updates the minimum required version of the vault gem and ensures that the vault-rails gem's version of the with_retries method passes the new error type (Vault::MissingRequiredStateError) as something to automatically retry on.

radditude commented 2 years ago

Taking over this review while Chris is out! Upon further investigation, we don't have any existing tests for any of the retry logic at all 😬

I think the best path forward would be to set up webmock and use that to mock the failing call and response to Vault, then use the allow_net_connect! option to allow further Vault requests to succeed normally. However, while setting up that testing would be a valuable maintenance backlog item, I'm pretty comfortable saying that it doesn't need to be a blocker for this PR!

I'm going to go ahead and approve (and then we can figure out why the tests are failing at the vault install step 🤔)