The Vault token is renewed from boot
Every datasource with a Vault credential failed at once after a quiet period: the deployment's periodic token had expired. Renewal ran only inside a Vault read, and a read happens only when such a datasource is resolved past the five-minute credential cache, so a 24-hour period could pass with nobody asking (docs/CONTEXT.md §4.5).
- The token is now renewed in the background from boot, in the studio, the worker and the agent alike: a one-minute tick, each renewing only when half the lease has passed. The token lives as long as any pod does.
- The first tick runs at boot, so an already-expired token is a warning (
Vault token renewal failed, status 403) in the process's first minute rather than the first failed datasource. - A 403 at renewal is asked again in a minute instead of silencing the renewal for the life of the process; a 400 (a token Vault does not renew) is still asked once.
Recovery for a token that already expired: create a new periodic token (vault token create -policy=dbportal -period=24h -orphan), store it as vault_token, sync.
Image: ghcr.io/klinux/dbportal:0.9.1 · chart 0.1.35.