search

hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.
https://hashicorp.com
Other
471 stars 102 forks source link

VaultDynamicSecrets do not revoke lease when associated kubernetes secret is deleted #935

Open dcaputo-harmoni opened 1 month ago

dcaputo-harmoni commented 1 month ago

Describe the bug When the kubernetes secret associated with a VaultDynamicSecret is deleted, the VSO requests a new lease and recreates the secret with the newly leased credentials. But the VSO does not revoke the previous lease before doing so, resulting in orphaned leases. Since the kubernetes secret is the only place that these credentials are used, it is effectively a proxy for the lease - and deleting it should revoke the lease. Or at a minimum, there should be an option to revoke the lease on secret deletion.

To Reproduce Steps to reproduce the behavior:

  1. Deploy a VaultDynamicSecret
  2. Delete the associated kubernetes secret
  3. A new lease will be obtained and a new kubernetes secret will be created
  4. The previous lease will remain in place
dcaputo-harmoni commented 1 month ago

One further thought on this - it could behave just like the revoke: true flag within the VaultDynamicSecret spec, however the trigger would also encompass deletion of the underlying kubernetes secret. It could be encompassed within the revoke setting (where setting to true triggers a revoke on either the VDS deletion or secret deletion), it could be a separate boolean setting such as revokeOnSecretDeletion, or make revoke a string or array setting that allows specifying which triggers would revoke - VDS, secret or both.

benashz commented 1 month ago

Thanks @dcaputo-harmoni, that's a good call out.