hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.
https://hashicorp.com
Other
436 stars 89 forks source link

Work around Vault DB static creds TTL rollover bug #730

Closed benashz closed 1 month ago

benashz commented 2 months ago

When syncing database static credentials role configured with scheduled rotation, the TTL is incorrectly rolled over within the same rotation period. Since, VSO relies on the TTL for its sync scheduling, an invalid TTL results in syncing stale credentials.

This fix, attempts to detect the TTL rollover bug, and ensure that current rotated creds are properly synced.