hashicorp / hashicorp/vault-secrets-operator
Rotate Credentials button in Static Role in VDS doesn't work for pods No rolling updates.
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description

**Describe the bug**
The "Rotate credentials" button in the image changes the DataBase password, but not the pod environment variable (Secret). You will not be able to connect.
The reason is obvious: the values of "rotationPeriod" and "rotationSchedule" in the VaultStaticCredsMetaData are not changed from the values when VaultDynamicSecrets is applied.
Therefore, the pod does not perform a rolling update when the "Rotate credentials" button is pressed.
This will cause a big problem in the future.
**To Reproduce**
Steps to reproduce the behavior:
1. Enable database engine for postgres
2. Create static role
3. Apply the CRD of VSO.
4. Specify Deployment to be rotated for VDS
5. Press Rotate credential
6. Pods don't do rolling updates.
Application deployment:
```yaml
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
name: vso-db-demo
namespace: default
spec:
allowStaticCreds: true
# Mount path of the secrets backend
mount: db/postgres
# Path to the secret
path: static-creds/postgres-role
# Where to store the secrets, end user will create the secret
destination:
create: true
name: db-secret
# Restart these pods when secrets rotated
rolloutRestartTargets:
- kind: Deployment
name: postgres
# Name of the CRD to authenticate to Vault
vaultAuthRef: vault-auth
```
**Expected behavior**
VDS(StaticRole) uses a single User, so when the RotateCredentials button is pressed, the Pod should do a rolling update and the Secret should be rewritten.
**Environment**
Kubernetes version:
EKS
vault: 1.15.1
vault-secrets-operator version: 0.4.0
postgres: 16.1.0
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the issue with the supplied VaultDynamicSecret manifest, PostgreSQL static role, and rolloutRestartTargets configuration. Then trace how VaultStaticCredsMetaData, Rotate credentials, Secret rewriting, and pod rollouts are handled. Done means rotating credentials updates the Secret and triggers a rolling update for the targeted pods.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, postgresql
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100