Expiration ahead of maxTtl

Problem
I'm trying to implement mongodb rotating secrets. While it's possible to achieve client lifecycle with more that one mongo-clients rolling up, it's hard to guarantee that new mongo client will be inicialised with new credentials before old credentials expires.

What I've tried
I've tried to use a custom scope with delayed mongo client destroy. It works better, because it allows queries to start and shutdown gracefully. However, test fails randomly because sometimes expiration happens before queries started, but after old client was gotten from the scope.

class MyService(
 val template:MongoTemplate
){


fun run(){
    // What happens here:
   // _template_ is fetched from the scope ( 20 ms until maxTtl )
   // expiration event happens by spring cloud vault ( 20 ms until maxTtl )
   // real expiration happens by vault ( maxTtl )
   // query is executed and fails
    template.findAll();
}

}

Solution
I think it's neccessary to be able to configure min time before maxTtl when expiration should happen.
If we have it as an option "expire-ahead-of-max-ttl-ms" in the example above:

// What happens here:
// template is got from the scope ( "expire-ahead-of-max-ttl-ms" + 20 ms until maxTtl )
// expiration event happens by spring cloud vault ("expire-ahead-of-max-ttl-ms" ms until maxTtl )

// query is executed
template.findAll();

// real expiration happens by vault ( maxTtl after "expire-ahead-of-max-ttl-ms" pass )

While we would be still needed to control MongoClient lifecycle, it would be at least possible to do

Another problem here is that vault (as far as I know) doesn't provide maxTtl information for the Lease
So we would need to have some approximate timer on an application side.

The issue names no source file or test. Start by locating Spring Cloud Vault lease-expiration and maxTtl handling, then inspect how scoped MongoClient instances are refreshed and destroyed. Done should include a configurable expiration-ahead interval that permits existing queries to finish before credentials expire, with tests covering the timing behavior.