hashicorp / hashicorp/vault-secrets-operator

AWS dynamic secret revoke not re-created

Open
#146 0 comments 0 reactions 0 assignees View on GitHub
dynamic enhancement needs-events
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
We have for security reason to revoke all our aws `iam_user`.
We have made it from the vault CLI.

But the VSO not update the secret automatically.

**To Reproduce**
Steps to reproduce the behavior:
1. deploy a VaultDynamicSecret that use an AWS dynamic creds
2. Wait the secret and `iam_user`creation
3. run `vault lease revoke --tls-skip-verify -force -prefix aws/creds`
5. AWS iam user is well deleted
6. but the Dynamic secret is not update and the iam user is not re-created (i have waited for 10min)

This seems related to the horizon that is very far.

**Expected behavior**
The revoke is propagated to the VaultDynamicSecret and a new Secret is generated with a new iam user

**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.):
* Other configuration options or runtime services (istio, etc.):
* vault-secrets-operator version:

**Additional context**
Add any other context about the problem here.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the behavior with a VaultDynamicSecret using AWS dynamic credentials, then run the documented `vault lease revoke --tls-skip-verify -force -prefix aws/creds` command and observe the operator. Done means the revoke is detected, the dynamic Secret is refreshed, and a new AWS IAM user is created.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.