Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable use of dynamic database credentials beyond max-tty #743

Open
shitikanth opened this issue Feb 18, 2025 · 2 comments
Open

Enable use of dynamic database credentials beyond max-tty #743

shitikanth opened this issue Feb 18, 2025 · 2 comments

Comments

@shitikanth
Copy link

The problem: Currently there is no way to use dynamic credentials using spring-cloud-vault-config-databases beyond the max lease time. The recommendation online seems to be to just let your container become unhealthy and let a new one replace it.

Proposed solution: VaultConfigDatabaseBootstrapConfiguration::DatabaseSecretBackendMetadataFactory::forDatabase can return a LeasingSecretBackendMetadata with lease mode set to ROTATE instead of a plain SecretBackendMetadata.

This would ensure that the lease gets rotated at expiry and the relevant database properties get updated. The responsibility of how to use the updated properties to update the connection pool can be left to the user.

@mp911de
Copy link
Member

mp911de commented Feb 18, 2025

Introducing ROTATE creates the expectation of credential propagation into the actual components as Spring Cloud Vault is built on top of Spring Boot. Right now, configuration properties objects aren't refreshed from Spring Boot and there is no propagation into Mongo Client, a connection pool, etc.

@shitikanth
Copy link
Author

shitikanth commented Feb 19, 2025

Would it be sufficient to document this limitation explicitly and give examples for how to setup the propagation for common use cases?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants