Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sidecar agent does not handle manually rotated static database secret #614

Open
tylerbrewer2 opened this issue Mar 20, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@tylerbrewer2
Copy link

tylerbrewer2 commented Mar 20, 2024

Describe the bug
When manually rotating a static database secret, the Vault sidecar agent will not inject the newly created credentials into the pod.

To Reproduce

  1. Deploy a pod using Vault sidecar to inject database credentials
  2. Manually rotate the static database credentials in Vault
  3. Pod will continue to use old credentials

Application deployment:

vault.hashicorp.com/agent-cache-enable: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-inject-command-db-creds: |
  ... command to kill container process ...
vault.hashicorp.com/agent-inject-secret-db-creds: database/static-creds/my_db_cred
vault.hashicorp.com/agent-inject-status: update
vault.hashicorp.com/agent-inject-template-db-creds: |
  ....
vault.hashicorp.com/agent-revoke-on-shutdown: "true"
vault.hashicorp.com/agent-run-as-same-user: "true"
vault.hashicorp.com/role: my_role
vault.hashicorp.com/template-static-secret-render-interval: 1m

Expected behavior
When a credential is manually rotated, I expect the Vault agent to inject the new credentials

Environment

  • Kubernetes version: 1.28.1
    • Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): EKS
  • vault-k8s version: 1.1.0
@tylerbrewer2 tylerbrewer2 added the bug Something isn't working label Mar 20, 2024
@srekkas
Copy link

srekkas commented Sep 19, 2024

Do you found solution? I think i have same problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants