vault-csi-provider icon indicating copy to clipboard operation
vault-csi-provider copied to clipboard

RabbitMQ secrets engine generates a new credential every two minutes

Open renan opened this issue 1 year ago • 0 comments

I have enabled and configured the RabbitMQ secrets engine to generate credentials for RabbitMQ as per this documentation: https://developer.hashicorp.com/vault/docs/secrets/rabbitmq

When consuming the path rabbitmq/creds/my-role from a SecretProviderClass, it works properly to generate the credentials on the fly. However, upon reaching the default rotation pool interval of 2 minutes configured in the Secrets Store CSI Driver, it will generate yet another credential.

You can see in the screenshot below that in 10~12 minutes it has generated 5 credentials. Because I have Reloader listening to the secrets, it also restarted the pod every 2 minutes.

Screenshot 2024-08-01 at 12 00 18

It would be great if Vault CSI Driver would inspect the generated credentials for its validity before generating a new one.

renan avatar Aug 01 '24 17:08 renan