SecretLeaseContainer not aware of Vault Session token expiry

[sczachariah]

Hello,

We have implemented database dynamic credentials using spring cloud vault bootstrap properties and utilising VaultLeaseConfig similar to in here (https://secrets-as-a-service.com/posts/hashicorp-vault/rotate-dynamic-relational-database-connection-in-spring-at-runtime/#:~:text=To%20rotate%20the%20database%20credentials,to%20use%20the%20new%20credentials) for updating the hikari properties runtime when the dynamic credentials change.

But we hit a snag every now and then when the session token expire.

So vault drops all the existing leases including database dynamic role lease, when the session token expire, irrespective of the ttl on dynamic role.

It seems SecretLeaseContainer is not aware of when the session token expire. As a result SecretLeaseExpired event is not fired and application goes into a fail state due to invalid db credentials, until the SecretLeaseContainer counts down on the ttl and fires next SecretLeaseExpiredEvent.

Related Issue: https://github.com/spring-cloud/spring-cloud-vault/issues/698

[sczachariah]

Could find some wording along the lines in HashiCorp docs -

https://developer.hashicorp.com/vault/docs/concepts/tokens#:~:text=After%20the%20current%20TTL%20is%20up%2C%20the%20token%20will%20no%20longer%20function%20%2D%2D%20it%2C%20and%20its%20associated%20leases%2C%20are%20revoked.

After the current TTL is up, the token will no longer function -- it, and its associated leases, are revoked