hashicorp / hashicorp/vault-secrets-operator

Rotate Credentials button in Static Role in VDS doesn't work for pods No rolling updates.

Open
#494 4 comments 2 reactions 0 assignees View on GitHub
enhancement vault-events
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

![Group 1](https://github.com/hashicorp/vault-secrets-operator/assets/82006976/289f9653-de01-48d9-b11d-c7d3e20be53f)

**Describe the bug**
The "Rotate credentials" button in the image changes the DataBase password, but not the pod environment variable (Secret). You will not be able to connect.
The reason is obvious: the values of "rotationPeriod" and "rotationSchedule" in the VaultStaticCredsMetaData are not changed from the values when VaultDynamicSecrets is applied.
Therefore, the pod does not perform a rolling update when the "Rotate credentials" button is pressed.
This will cause a big problem in the future.

**To Reproduce**
Steps to reproduce the behavior:
1. Enable database engine for postgres
2. Create static role
3. Apply the CRD of VSO.
4. Specify Deployment to be rotated for VDS
5. Press Rotate credential
6. Pods don't do rolling updates.

Application deployment:

```yaml
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
name: vso-db-demo
namespace: default
spec:
allowStaticCreds: true
# Mount path of the secrets backend
mount: db/postgres

# Path to the secret
path: static-creds/postgres-role

# Where to store the secrets, end user will create the secret
destination:
create: true
name: db-secret

# Restart these pods when secrets rotated
rolloutRestartTargets:
- kind: Deployment
name: postgres

# Name of the CRD to authenticate to Vault
vaultAuthRef: vault-auth
```

**Expected behavior**
VDS(StaticRole) uses a single User, so when the RotateCredentials button is pressed, the Pod should do a rolling update and the Secret should be rewritten.

**Environment**
Kubernetes version:
EKS
vault: 1.15.1
vault-secrets-operator version: 0.4.0
postgres: 16.1.0

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the issue with the supplied VaultDynamicSecret manifest, PostgreSQL static role, and rolloutRestartTargets configuration. Then trace how VaultStaticCredsMetaData, Rotate credentials, Secret rewriting, and pod rollouts are handled. Done means rotating credentials updates the Secret and triggers a rolling update for the targeted pods.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, postgresql
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.