hashicorp-vault-plugin icon indicating copy to clipboard operation
hashicorp-vault-plugin copied to clipboard

Revoking LeaseId's via the Disposer

Open jpatterson-fastly opened this issue 3 years ago • 0 comments

I've noticed that secrets provisioned on the dynamic engine (eg. GCP) no longer get revoked when a pipeline is finished with them (exits the withVault block), and instead the generated key within the serviceAccount remains active until its TTL expires. This is problematic, since GCP has a limit of 10 keys per svcAcc, so revoking these leases is important as soon as the requester is done with them.

Between tags hashicorp-vault-plugin-2.2.0 &hashicorp-vault-plugin-3.0.0, the VaultDisposer is no longer setup/used, and im struggling to find amongst commit comments why that was? I see some references to "auto-auth" in some comments surrounding when this happened in gitlogs, but unsure what thats referencing (possibly some auto revoking feature in kv engine V2?), since lease's no longer seem to be explicitly revoked in the plugin ....

For reference, we are still using secrets engine V1

Disposer being set in 2.2: https://github.com/jenkinsci/hashicorp-vault-plugin/blob/hashicorp-vault-plugin-2.2.0/src/main/java/com/datapipe/jenkins/vault/VaultBuildWrapper.java#L92

jpatterson-fastly avatar Nov 16 '20 22:11 jpatterson-fastly