hashicorp / hashicorp/vault-secrets-operator

VaultDynamicSecrets do not revoke lease when associated kubernetes secret is deleted

Open
#935 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
601
Forks
145
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
When the kubernetes secret associated with a VaultDynamicSecret is deleted, the VSO requests a new lease and recreates the secret with the newly leased credentials. But the VSO does not revoke the previous lease before doing so, resulting in orphaned leases. Since the kubernetes secret is the only place that these credentials are used, it is effectively a proxy for the lease - and deleting it should revoke the lease. Or at a minimum, there should be an option to revoke the lease on secret deletion.

**To Reproduce**
Steps to reproduce the behavior:
1. Deploy a VaultDynamicSecret
2. Delete the associated kubernetes secret
3. A new lease will be obtained and a new kubernetes secret will be created
4. The previous lease will remain in place

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing VaultDynamicSecret reconciliation when its associated Kubernetes Secret is deleted, focusing on how the existing lease and newly requested lease are handled. Done means deleting the Secret revokes the previous lease before a replacement is created, with coverage for the reproduced sequence.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.