ilijamt / vault-plugin-secrets-gitlab

Vault Plugin for Gitlab Access Tokens
MIT License
43 stars 6 forks source link

How to rotate expired Tokens? #104

Closed chainmywallet closed 4 weeks ago

chainmywallet commented 1 month ago

Due to the GitLab Changes most of my tokens are expired (around 100), so I need a way to rotate all expired tokens. I already setup everything, also a desired project role

/ $ vault read gitlab/roles/project
Key                     Value
---                     -----
access_level            maintainer
gitlab_revokes_token    false
name                    semantic-release
path                    path/to/my/project
role_name               project
scopes                  [api]
token_type              project
ttl                     8760h

But my token is still expired

Project access token: path/to/my/project              | semantic-release   | 2022-10-26 14:25:27 | 2024-07-11 19:55:05 | 2024-07-22 00:00:00 | expired

Config:

/ $ vault read gitlab/config
Key                   Value
---                   -----
auto_rotate_before    48h0m0s
auto_rotate_token     true
base_url              my_instance
scopes                api, read_api
token_created_at      2024-07-23T10:24:26Z
token_expires_at      2024-07-23T10:57:33Z
token_id              <REDUCTED>
token_sha1_hash       <REDUCTED>

Did I misunderstood something? Is this plugin only for rotating not expired tokens?

The problem is pretty urgent, because most of the pipeline aren't working anymore.

Thanks in advance!

ilijamt commented 4 weeks ago

It needs an active token to rotate the token. So if your token is expired it's not possible to create new tokens or rotate the main token. Just create a new token and update the configuration.