reference resolving issue

[smiklos]

Is there an existing issue for this?

• I have searched the existing issues

Kong version ($ kong version)

3.6.0

Current Behavior

We are using Kong Konnect with Azure Vault and vault entities. Periodically in the logs of the dataplane we see warnings indicating secret rotation failures for secrets that belong to these vault entities.

The vault we configure on the dataplane level does work and we are paying customers.

2024/03/07 20:21:38 [warn] 2382#0: *5 [kong] init.lua:1836 unable to resolve reference {vault://a-vault/a-secret-a} (vault azure requires a license to be used), context: ngx.timer

I somehow believe that the timer thread doesn't get the licensing propagated to it.
The error is coming from here. https://github.com/Kong/kong/blob/3.6.0/kong/pdk/vault.lua#L685

I'd debug this but I can't find any reference in the code for licensing however based on the logs it seems that this is some background job complaining during reference rotation activities ultimately coming from here

kong/kong/db/schema/init.lua

Line 1864 in 2bf7e5a

kong.log.warn("unable to resolve reference ", v, " (", err, ")")

I don't see these errors when we update the references in the UI. I think those do rotate the references straight away so it seems it works in that phase.

Expected Behavior

I should not see these warnings in the log and rotation should work

Steps To Reproduce

Use Konnect and create a control plane group, add a control plane.
Configure azure vault on the dataplane.
Add a vault entity using the configured client id for vault.
Add an azure vault reference to a plugin that supports such field.
wait for the periodic job to kick in.

Anything else?

No response

[chronolaw]

I think that you could create a ticket to track it since you are paying customer, then you will get the response in time.

[bungle]

@smiklos, we have fixed it two weeks ago, it is waiting for next release(s).

[StarlightIbuki]

Closing as we already have a fix. Please reopen if you have further concerns.