Vault-agent sidecar does not update the secret for kvv1

[visheshtanksale]

Vault agent sidecar does not update the secrets on the pod volume mount if the the secret is created using kvv1 secrets engine. Is this supported? Is this a limitation of kvv1 secrets engine?

[jasonodonnell]

Hi @visheshtanksale, you need to lower the ttl of your KV secret.

vault kv put kv/my-secret ttl=1m my-value=foobar

[visheshtanksale]

Thanks @jasonodonnell . So for secrets generate using kvv2 is the metadata stored with secrets used by vault-agent to determine if it needs to pull the secret?

[jasonodonnell]

KVV2 doesn't actually have leases, so Consul Template will default to 5 minutes. You should see it update after 5 minutes. This is not configurable, unfortunately, and is a limitation of Consul Template (which is what vault agent templating uses).

[YesYouKenSpace]

Thank you @jasonodonnell

Does anyone know if these in the docs for vault agent sidecar? I think this is an important piece of information. And it took me a while to find this.

[mrbrandao]

@jasonodonnell

KVV2 doesn't actually have leases, so Consul Template will default to 5 minutes. You should see it update after 5 minutes. This is not configurable, unfortunately, and is a limitation of Consul Template (which is what vault agent templating uses).

Seems these changes can solve this issue #276 am I correct?