[feature] Auto revoke Vault token on Agent Shutdown

[lawliet89]

Is your feature request related to a problem? Please describe.
When running Vault agent as sidecars on non-Nomad orchestration tools like Kubernetes, it is desirable to immediately revoke the Vault token on application shutdown, especially when dealing with credentials that have numerical limits like the GCP Secrets engine service account keys.

Describe the solution you'd like

Add an option to configure the auto-auth feature in Vault agent to revoke access tokens when shutting down. Would be great if it comes with a "grace" period setting that waits x seconds before revoking the token.

Describe alternatives you've considered

• Wrapping the invocation of Vault agent in bash scripts to trap termination and revoke tokens
• Use "termination" features in the orchestrator to do the revoking.

[ncabatoff]

Doing things "on shutdown" is inherently unreliable, since there are cases where the application isn't given the chance to cleanup on exit (e.g. machine crashing, kill -9) or where the application doesn't shutdown but is abandoned by the cluster (e.g. node is on the other side of quorum during a network partition). Why not simply use a short TTL, say 30s, and then all such cases will be handled?

[lawliet89]

That's possible too, although the increase in the volume of renewals will make the audit logs super noisy.

Between choosing a short TTL and the alternatives I've considered, I wouldn't go for a short TTL.

I mean this could be done on a "best effort" basis. The TTL will be a "backup" in case this fails.

[jefferai]

I don't see any issue with defense in depth.

[TJM]

There is a setting in the Kubernetes agent injector to revoke on shutdown.

https://github.com/hashicorp/vault-helm/blob/main/values.yaml#L91-L92

It shouldn't be too hard to adapt that to whatever you are doing (not injector?)

[lawliet89]

@TJM that setting is a workaround that I implemented for vault-k8s in hashicorp/vault-k8s#67

There is no magic involved. It's just a pod pre-stop hook to use Vault CLI to request a revocation. It's not foolproof. This issue is requesting for a "native" solution.

[hsimon-hashicorp]

Hi folks! Is this still an issue in newer versions of Vault? Please let me know so I can bubble it up accordingly. Thanks!

[lawliet89]

I scanned through the documentation for Vault Agent and I don't see any option to revoke on shutdown.