kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-08 19:35:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

vault: set renew increment to lease duration (#26041)

Browse Source 
When we renew Vault tokens, we use the lease duration to determine how often to
renew. But we also set an `increment` value which is never updated from the
initial 30s. For periodic tokens this is not a problem because the `increment`
field is ignored on renewal. But for non-periodic tokens this prevents the token
TTL from being properly incremented. This behavior has been in place since the
initial Vault client implementation in #1606 but before the switch to workload
identity most (all?) tokens being created were periodic tokens so this was never
detected.

Fix this bug by updating the request's `increment` field to the lease duration
on each renewal.

Also switch out a `time.After` call in backoff of the derive token caller with a
safe timer so that we don't have to spawn a new goroutine per loop, and have
tighter control over when that's GC'd.

Ref: https://github.com/hashicorp/nomad/pull/1606
Ref: https://github.com/hashicorp/nomad/issues/25812
This commit is contained in:
Tim Gross
2025-06-13 13:50:54 -04:00
committed by GitHub
parent fedd042e69
commit 26004c5407
8 changed files with 97 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
client/allocrunner/taskrunner/task_runner_linux_test.go
View File

@@ -35,8 +35,8 @@ func TestTaskRunner_DisableFileForVaultToken_UpgradePath(t *testing.T) {
// Setup a test Vault client.
token := "1234"
handler := func(ctx context.Context, req vaultclient.JWTLoginRequest) (string, bool, error) {
return token, true, nil
handler := func(ctx context.Context, req vaultclient.JWTLoginRequest) (string, bool, int, error) {
return token, true, 30, nil
}
vc, err := vaultclient.NewMockVaultClient(structs.VaultDefaultCluster)
must.NoError(t, err)