hashicorp-vault-plugin icon indicating copy to clipboard operation
hashicorp-vault-plugin copied to clipboard

Fix token caching for multi-cluster multi-namespace environments

Open dee-kryvenko opened this issue 2 years ago • 3 comments

See https://github.com/jenkinsci/hashicorp-vault-plugin/issues/260. New implementation uses caching criteria to differentiate tokens for different environments. So far I only came up with two possible attributes - server address and a namespace, but I have created CacheKey to allow for easy extension later on if more colliding attributes will be discovered. I have also added transient where I think it applies since I do not think we want to cache be ever written to the disk. I also added a little thread safety, although I am not sure if it is necessary (and I did not observe any issues with it so far) but it felt like it is.

  • [x] Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • [x] Ensure that the pull request title represents the desired changelog entry
  • [x] Please describe what you did
  • [x] Link to relevant issues in GitHub or Jira
  • [x] Link to relevant pull requests, esp. upstream and downstream changes
  • [x] Ensure you have provided tests - that demonstrates feature works or fixes the issue

dee-kryvenko avatar Oct 04 '22 22:10 dee-kryvenko

@jglick this has been open for more a year, and the plugin is basically broken and unusable. I am not 100% sure but I think it will affect in-cluster JWT auth too for when jenkins is in k8s. Will this ever be merged? How is anyone using it, does everybody using static tokens and are happy?

dee-kryvenko avatar Oct 13 '23 17:10 dee-kryvenko

I am not a maintainer of this plugin (and do not even know much about it) so I am not sure why you are mentioning me.

jglick avatar Oct 16 '23 18:10 jglick

@jglick sorry, I looked at the last commit author and since you are everywhere I just assumed you might be a right person to tag.

cc @jetersen please see above. This is a critical issue, and it renders this plugin unusable for anyone having more than one vault cluster in the environment. I have been running a custom build with my fix in production large scale environment for a year now and there are no issues.

dee-kryvenko avatar Oct 16 '23 18:10 dee-kryvenko