Vault client certificates aren't reread on reload
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
Specifically, the certificate used/referred to in the `vault.cert_file` and `vault.key_file` sections of the nomad config. The other certs are reloaded/reread on SIGHUP, but not that one.
It's what I've observed experimentally but it would take a bit of work to set this up for me to be able to log and demonstrate it. My understanding is that nomad doesn't reload every config value so this isn't something I'd have to demonstrate/prove deeply, but I can if the symptoms sound surprising.
Contributor guide
No contributing guide indexed for this repository
Research direction
Trace the Nomad configuration handling for vault.cert_file and vault.key_file, then compare it with the other certificate paths during SIGHUP reload. Reproduce or verify the reported behavior and update the reload path so those certificates are reread on SIGHUP; done means renewed certificates are used after reload.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100