Expose `static_secret_render_interval` from consul-template
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Proposal
Nomad leverages consul-template, which results in a great ability to pull secrets out of vault. Unfortunately, there are some limitations when doing this with Consul KVv2. To work around a limitation in vault, I'd like to be able to specify the `static_secret_render_interval` token per template in order to define a maximum level of staleness that I can accept for static secrets. For context, please see hashicorp/vault#6274.
### Use-cases
Void Linux stores TLS certificates from LetsEncrypt in vault, and when these certificates are renewed, nomad doesn't re-render the templates to update the keys/certs that nginx has access to.
### Attempted Solutions
Asking the vault folks first to see if there's something I can do to work around this. Otherwise I now have google calendar entries to remind me to go restart certain nomad jobs every 2 months.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at Nomad's consul-template integration and the template configuration entry points, then trace how Vault static secrets are configured per template. Check how consul-template exposes static_secret_render_interval and review existing integration tests. Done means callers can set the interval for an individual template and certificate updates trigger the expected re-render behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100