Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vault-agent sidecar does not update the secret for kvv1 #107

Open
visheshtanksale opened this issue Mar 19, 2020 · 5 comments
Open

Vault-agent sidecar does not update the secret for kvv1 #107

visheshtanksale opened this issue Mar 19, 2020 · 5 comments
Labels
docs Improvements or additions to documentation enhancement New feature or request

Comments

@visheshtanksale
Copy link

Vault agent sidecar does not update the secrets on the pod volume mount if the the secret is created using kvv1 secrets engine. Is this supported? Is this a limitation of kvv1 secrets engine?

@jasonodonnell
Copy link
Contributor

Hi @visheshtanksale, you need to lower the ttl of your KV secret.

vault kv put kv/my-secret ttl=1m my-value=foobar

@visheshtanksale
Copy link
Author

Thanks @jasonodonnell . So for secrets generate using kvv2 is the metadata stored with secrets used by vault-agent to determine if it needs to pull the secret?

@jasonodonnell
Copy link
Contributor

KVV2 doesn't actually have leases, so Consul Template will default to 5 minutes. You should see it update after 5 minutes. This is not configurable, unfortunately, and is a limitation of Consul Template (which is what vault agent templating uses).

@YesYouKenSpace
Copy link

Thank you @jasonodonnell

Does anyone know if these in the docs for vault agent sidecar? I think this is an important piece of information. And it took me a while to find this.

@tvoran tvoran added docs Improvements or additions to documentation enhancement New feature or request labels Mar 27, 2020
@mrbrandao
Copy link

mrbrandao commented Aug 11, 2021

@jasonodonnell

KVV2 doesn't actually have leases, so Consul Template will default to 5 minutes. You should see it update after 5 minutes. This is not configurable, unfortunately, and is a limitation of Consul Template (which is what vault agent templating uses).

Seems these changes can solve this issue #276 am I correct?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs Improvements or additions to documentation enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

5 participants