hashicorp-vault-plugin
hashicorp-vault-plugin copied to clipboard
Fix token caching for multi-cluster multi-namespace environments
See https://github.com/jenkinsci/hashicorp-vault-plugin/issues/260.
New implementation uses caching criteria to differentiate tokens for different environments. So far I only came up with two possible attributes - server address and a namespace, but I have created CacheKey
to allow for easy extension later on if more colliding attributes will be discovered. I have also added transient
where I think it applies since I do not think we want to cache be ever written to the disk. I also added a little thread safety, although I am not sure if it is necessary (and I did not observe any issues with it so far) but it felt like it is.
- [x] Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
- [x] Ensure that the pull request title represents the desired changelog entry
- [x] Please describe what you did
- [x] Link to relevant issues in GitHub or Jira
- [x] Link to relevant pull requests, esp. upstream and downstream changes
- [x] Ensure you have provided tests - that demonstrates feature works or fixes the issue
@jglick this has been open for more a year, and the plugin is basically broken and unusable. I am not 100% sure but I think it will affect in-cluster JWT auth too for when jenkins is in k8s. Will this ever be merged? How is anyone using it, does everybody using static tokens and are happy?
I am not a maintainer of this plugin (and do not even know much about it) so I am not sure why you are mentioning me.
@jglick sorry, I looked at the last commit author and since you are everywhere I just assumed you might be a right person to tag.
cc @jetersen please see above. This is a critical issue, and it renders this plugin unusable for anyone having more than one vault cluster in the environment. I have been running a custom build with my fix in production large scale environment for a year now and there are no issues.