agent/proxy: stop caching lease and token renewal responses#32009
Open
tomer-1 wants to merge 3 commits into
Open
agent/proxy: stop caching lease and token renewal responses#32009tomer-1 wants to merge 3 commits into
tomer-1 wants to merge 3 commits into
Conversation
- The lease cache keyed cacheability off the response shape, so a response to sys/leases/renew (which echoes the lease_id) was cached and given its own renewer. - A proxied client's lifetime watcher then kept receiving a stale, non-decreasing TTL from the cache and could not see the lease nearing its max_ttl, letting dynamic-secret leases expire before a refresh. - Pass lease renewal requests through to Vault instead of caching them. The cache's own background renewer is unaffected: it renews via a direct client clone, not back through Send(). - Add isLeaseRenewalRequest, reusing the existing path/namespace convention; it covers sys/leases/renew, the lease-id URL form, and the legacy sys/renew alias. - Add regression tests for the matcher and for the non-caching behavior. - Fixes hashicorp#19684 Signed-off-by: Tomer H <tomer@rhinofcp.com>
|
Deployment failed with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
dosubot
Bot
added
size:M
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dosubot
Bot
added
core/lease
regression
|
Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement Learn more about why HashiCorp requires a CLA and what the CLA includes Have you signed the CLA already but the status is still pending? Recheck it. |
Signed-off-by: Tomer H <tomer@rhinofcp.com>
tomer-1
changed the title
- Extend the renewal pass-through to auth/token/renew and auth/token/renew-self, whose responses echo the existing token's auth and were otherwise cached and given their own renewer. - A proxied client renewing its own token through the proxy hit the same stale, non-decreasing TTL problem as dynamic-secret leases. - Rename isLeaseRenewalRequest to isRenewalRequest and add the token endpoints to renewalPaths. - Extend regression tests to cover token renewal.
Author
|
sorry for the delay. |
Contributor
Sounds good! Make sure the corporate CLA has your GitHub-associated email address and this username. Thanks much! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Vault Agent and Proxy can fail to refresh a dynamic secret before its lease
expires when the lease cache is enabled (typically alongside
use_auto_auth_token). The lease cache decides what to cache from the responseshape, so a response to
sys/leases/renew(which echoes thelease_id) orauth/token/renew(which echoes theauth) is treated as a newly issuedlease/token: it is stored and given its own background renewer. A proxied
client's own lifetime watcher (for example
consul-templaterunning insideAgent) then keeps receiving the cached, non-decreasing TTL, never observes the
lease/token approaching its
max_ttl, and lets it expire before fetching areplacement.
This PR stops caching responses to lease- and token-renewal requests and proxies
them through to Vault verbatim, so the client's lifetime watcher sees the true
remaining TTL. The lease cache's own background renewer is unaffected — it renews
the leases it cached at issuance time via a direct client clone, not back through
Send().sys/leases/renew(including the:lease_idURL form and the legacysys/renewalias),auth/token/renew, andauth/token/renew-selfthroughinstead of caching them.
isRenewalRequest, reusing the existing path/namespace matching conventionalready used for revocation paths.
both lease and token renewals.
Fixes #19684
TODO only if you're a HashiCorp employee
backport/label that matches the desired release branch.PCI review checklist
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.