Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make VPS integration tests fail early #700

Draft
wants to merge 23 commits into
base: main
Choose a base branch
from

Conversation

benashz
Copy link
Collaborator

@benashz benashz commented Apr 22, 2024

No description provided.

In the case where a lifetimeWatcher fails to renew the Vault client
lease, we want all related VDS instances to be synced. This helps to
mitigate the issue where an external revocation of the client token
causes the issued secret leases to be revoked. In that case VSO would
have no idea that the token has been revoked.

The ideal TTL for the client token should be relatively short, e.g. 1m,
so as to trigger the lifetimeWatcher earlier.

In the future, VSO will be able to subscribe to lease revocation events
from Vault. In that case, VSO will be able to perform the sync
immediately.
The Client ID is the hash of the Vault secret's accessor.

- VDS: trigger sync on Vault Client ID changes
- remove the called back client from the factory's cache to ensure that
  any of its clones are purged. The next call to Sync() will get a new
  client back
- fix bogus lock handling in the factory's Get()
Base automatically changed from VAULT-25273/vds-trigger-reconciliation-on-token-errors to main April 24, 2024 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant