hashicorp / hashicorp/vault-secrets-operator
AWS dynamic secret revoke not re-created
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
We have for security reason to revoke all our aws `iam_user`.
We have made it from the vault CLI.
But the VSO not update the secret automatically.
**To Reproduce**
Steps to reproduce the behavior:
1. deploy a VaultDynamicSecret that use an AWS dynamic creds
2. Wait the secret and `iam_user`creation
3. run `vault lease revoke --tls-skip-verify -force -prefix aws/creds`
5. AWS iam user is well deleted
6. but the Dynamic secret is not update and the iam user is not re-created (i have waited for 10min)
This seems related to the horizon that is very far.
**Expected behavior**
The revoke is propagated to the VaultDynamicSecret and a new Secret is generated with a new iam user
**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.):
* Other configuration options or runtime services (istio, etc.):
* vault-secrets-operator version:
**Additional context**
Add any other context about the problem here.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the behavior with a VaultDynamicSecret using AWS dynamic credentials, then run the documented `vault lease revoke --tls-skip-verify -force -prefix aws/creds` command and observe the operator. Done means the revoke is detected, the dynamic Secret is refreshed, and a new AWS IAM user is created.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- cloud, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100