hashicorp / hashicorp/nomad

Expose `static_secret_render_interval` from consul-template

Open
#17,423 1 comment 1 reaction 0 assignees View on GitHub
stage/accepted stage/waiting-on-upstream theme/consul-template type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Proposal

Nomad leverages consul-template, which results in a great ability to pull secrets out of vault. Unfortunately, there are some limitations when doing this with Consul KVv2. To work around a limitation in vault, I'd like to be able to specify the `static_secret_render_interval` token per template in order to define a maximum level of staleness that I can accept for static secrets. For context, please see hashicorp/vault#6274.

### Use-cases

Void Linux stores TLS certificates from LetsEncrypt in vault, and when these certificates are renewed, nomad doesn't re-render the templates to update the keys/certs that nginx has access to.

### Attempted Solutions

Asking the vault folks first to see if there's something I can do to work around this. Otherwise I now have google calendar entries to remind me to go restart certain nomad jobs every 2 months.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at Nomad's consul-template integration and the template configuration entry points, then trace how Vault static secrets are configured per template. Check how consul-template exposes static_secret_render_interval and review existing integration tests. Done means callers can set the interval for an individual template and certificate updates trigger the expected re-render behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.