hashicorp / hashicorp/vault-secrets-operator
VaultDynamicSecrets do not revoke lease when associated kubernetes secret is deleted
- Dominant language
- Go
- Stars
- 601
- Forks
- 145
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
When the kubernetes secret associated with a VaultDynamicSecret is deleted, the VSO requests a new lease and recreates the secret with the newly leased credentials. But the VSO does not revoke the previous lease before doing so, resulting in orphaned leases. Since the kubernetes secret is the only place that these credentials are used, it is effectively a proxy for the lease - and deleting it should revoke the lease. Or at a minimum, there should be an option to revoke the lease on secret deletion.
**To Reproduce**
Steps to reproduce the behavior:
1. Deploy a VaultDynamicSecret
2. Delete the associated kubernetes secret
3. A new lease will be obtained and a new kubernetes secret will be created
4. The previous lease will remain in place
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing VaultDynamicSecret reconciliation when its associated Kubernetes Secret is deleted, focusing on how the existing lease and newly requested lease are handled. Done means deleting the Secret revokes the previous lease before a replacement is created, with coverage for the reproduced sequence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100