Renewal of vault auth token

[Pratiyush05Pushkar]

Hi all ,

Use case

In general , teams don't use vault root token to access vault from this application (In their PROD env) . If those tokens are made renewable , we can periodically renew those tokens from vault client . So once those tokens are set and this application has been deployed , there wont be any downtime due to vault auth token expiration .

Our scenario

We have deployed this in our PROD env where it access PROD vault with a token ( max life time can be set to 32 days ) . So once that token expires , we need to create another token from vault and re-deploy this app with the new token . This creates some downtime for the application .

In this PR

There is already an api in vault client (NewLifeTimeWatcher ) which renews the secrets passed to it . I used code from this function to call NewLifeTimeWatcher in a separate goroutine to renew vault auth token .

We can create renewable vault token with max_ttl_time 0s (no max_ttl ) and 32 days as expiration time by the following commands -

vault token create -policy=<POLICY_NAME> -period=768h

And then set it as VAULT_TOKEN env in docker image/container and deploy the app . This token is being used to access VAULT and when it nears its expiration time , it gets renewed by NewLifeTimeWatcher goroutine .

Outputs

Configuration used for this output -

1. created vault auth token with validity of 6 minutes . Thats why output says remaining duration: 360 s
2. Used docker-compose for running this app .(Set VAULT_TOKEN and VAULT_ADDR in docker-compose.yaml)

Issue

In case of root token which is being used in DEV mode , root tokens are not renewable so the output shows an error on its renewal for once .

Hope you people like this PR . I am open for any feedback .

[ankit-ls]

@eranchetz Could you please look at this PR? This would help us in auto-renewing vault tokens for supersecret. Currently it is a chore work to manually update these tokens after 30 days (as vault does not support issuing tokens longer than 30 days).

[eranchetz]

Sorry for the delay on my side,
Since we do not have a test for that, I would hopefully be able to test it manually this week and merge it

[ankit-ls]

Thanks @eranchetz , appreciate your quick response. 🙂