Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parameterise token renewal intervals #50

Merged

Conversation

moertel
Copy link
Contributor

@moertel moertel commented Sep 27, 2020

For particular Vault setups, the default values for token renewals might
not be a good fit. This commit adds a parametrisation, so that the time
between a successful or failed token renewal and the next renewal attempt
can be controlled via optional environment variables.

VAULT_TOKEN_RENEWAL_INTERVAL:

  • The time (in seconds) between a successful token renewal and the
    next renewal attempt. Default: 50% of the token lease duration

VAULT_TOKEN_RENEWAL_RETRY_INTERVAL:

  • The time (in seconds) between a failed token renewal and the next
    renewal attempt. Default: 30 seconds

Refs #48

For particular Vault setups, the default values for token renewals might
not be a good fit. This commit adds a parametrisation, so that the time
between a successful or failed token renewal and the next renewal attempt
can be controlled via optional environment variables.

VAULT_TOKEN_RENEWAL_INTERVAL:
    The time (in seconds) between a successful token renewal and the
    next renewal attempt. Defaults to 50% of the token lease duration.

VAULT_TOKEN_RENEWAL_RETRY_INTERVAL:
    The time (in seconds) between a failed token renewal and the next
    renewal attempt. Defaults to 30 seconds.

Refs ricoberger#48
@moertel
Copy link
Contributor Author

moertel commented Sep 27, 2020

@ricoberger there you go. :) As the environment variables only make sense for token-based auth, I followed the style for configuring VAULT_TOKEN_LEASE_DURATION and added documentation to the Kubernetes secret as well as the Helm chart values but did not include it in the Helm templates themselves.

In order to maintain the previous renewal interval exactly, I made the values float instead of int.

@ricoberger
Copy link
Owner

Looks great. Thank you very much 🙂

@ricoberger ricoberger merged commit d3e05c7 into ricoberger:master Sep 28, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants