{"action":"created","issue":{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/issues/256","repository_url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault","labels_url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/issues/256/labels{/name}","comments_url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/issues/256/comments","events_url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/issues/256/events","html_url":"https://github.com/spring-cloud/spring-cloud-vault/issues/256","id":373974456,"node_id":"MDU6SXNzdWUzNzM5NzQ0NTY=","number":256,"title":"Cannot renew a MongoDB lease due to lease expired","user":{"login":"tonny1983","id":8895687,"node_id":"MDQ6VXNlcjg4OTU2ODc=","avatar_url":"https://avatars2.githubusercontent.com/u/8895687?v=4","gravatar_id":"","url":"https://api.github.com/users/tonny1983","html_url":"https://github.com/tonny1983","followers_url":"https://api.github.com/users/tonny1983/followers","following_url":"https://api.github.com/users/tonny1983/following{/other_user}","gists_url":"https://api.github.com/users/tonny1983/gists{/gist_id}","starred_url":"https://api.github.com/users/tonny1983/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tonny1983/subscriptions","organizations_url":"https://api.github.com/users/tonny1983/orgs","repos_url":"https://api.github.com/users/tonny1983/repos","events_url":"https://api.github.com/users/tonny1983/events{/privacy}","received_events_url":"https://api.github.com/users/tonny1983/received_events","type":"User","site_admin":false},"labels":[{"id":324422525,"node_id":"MDU6TGFiZWwzMjQ0MjI1MjU=","url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/labels/for:%20stackoverflow","name":"for: stackoverflow","color":"c5def5","default":false},{"id":324422524,"node_id":"MDU6TGFiZWwzMjQ0MjI1MjQ=","url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/labels/status:%20invalid","name":"status: invalid","color":"fef2c0","default":false},{"id":324422520,"node_id":"MDU6TGFiZWwzMjQ0MjI1MjA=","url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/labels/type:%20bug","name":"type: bug","color":"d4c5f9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-10-25T14:24:44Z","updated_at":"2018-10-27T03:09:47Z","closed_at":null,"author_association":"NONE","body":"**How To Reproduce**\r\n\r\n- Vault Server Configuration\r\n\r\n1. Start vault server in dev mode \r\n`vault server -dev`\r\n\r\n1. Enable app-role \r\n`vault auth enable approle`\r\n\r\n1. Import a policy \r\n`vault write sys/policy/demo-policy policy=@demo-policy.hcl` (the file is listed later)\r\n\r\n1. Create an app role with unlimited tokens and secret ids \r\n`vault write auth/approle/role/readwrite secret_id_ttl=100m token_num_uses=0 token_ttl=100m token_max_ttl=100m secret_id_num_uses=0 policies=\"default,demo-policy\"`\r\n\r\n1. Enable database secrets `vault secrets enable database`\r\n\r\n1. Configure MongoDB connection info. \r\n`vault write database/config/vault-mongodb-demo-database plugin_name=mongodb-database-plugin  allowed_roles=\"readwrite\"  connection_url=\"mongodb://{{username}}:{{password}}@[myip]/admin?ssl=false\" username=\"[myusername]\" password=\"[mypassword]\"`\r\n\r\n1. Configure a role that maps a name\r\n`vault write database/roles/readwrite db_name=vault-mongodb-demo-database creation_statements='{ \"db\": \"vaultdemo\", \"roles\": [{ \"role\": \"dbOwner\" }, {\"role\": \"readWrite\", \"db\": \"vaultdemo\"}] }' default_ttl=\"1m\" max_ttl=\"1m\"`\r\n\r\n1. Get roleid which will be the value of `spring.cloud.vault.app-role.role-id`\r\n`vault read auth/approle/role/readwrite/role-id`\r\n\r\n1. Get secret id which will be the value of `spring.cloud.vault.app-role.secret-id`\r\n`vault write -f auth/approle/role/readwrite/secret-id`\r\n\r\n- demo-policy.hcl file\r\n```\r\npath \"secret/bootstrap\" {\r\n\tcapabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\r\n}\r\npath \"secret/application\" {\r\n\tcapabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\r\n}\r\npath \"database/creds/readwrite\" {\r\n\tcapabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\r\n}\r\npath \"database/creds/readwrite/*\" {\r\n        capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\r\n}\r\npath \"sys/leases/*\" {\r\n\tcapabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\r\n}\r\n```\r\n\r\n- bootstrap.yml file\r\n```\r\nspring:\r\n  cloud:\r\n    vault:\r\n      host: localhost\r\n      port: 8200\r\n      scheme: http\r\n      uri: http://localhost:8200\r\n      connection-timeout: 5000\r\n      read-timeout: 15000\r\n      config:\r\n        lifecycle:\r\n          enabled: true\r\n        order: -10\r\n      authentication: APPROLE\r\n      app-role:\r\n        role-id: [from step 8]\r\n        secret-id: [from step 9]\r\n      mongodb:\r\n        enabled: true\r\n        role: readwrite\r\n        backend: database\r\n        username-property: mongodb.username\r\n        password-property: mongodb.password\r\n```\r\n\r\n- Components version\r\n\r\n1. Spring Boot `2.0.6.RELEASE`\r\n\r\n1. Spring Cloud `Finchley.SR1`\r\n\r\n1. Spring Vault core `2.1.1.BUILD-SNAPSHOT`\r\n\r\n1. Vault `v0.11.4`\r\n\r\n**Error Description**\r\n\r\nAfter about 1 minute from starting the demo app, I got the following exception:\r\n```\r\n2018-10-25 22:11:26.616  WARN 5446 --- [g-Cloud-Vault-2] LeaseEventPublisher$LoggingErrorListener : [RequestedSecret [path='database/creds/readwrite', mode=RENEW]] Lease [leaseId='database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V', leaseDuration=PT10S, renewable=true] Cannot renew lease: lease expired\r\n\r\norg.springframework.vault.VaultException: Cannot renew lease: lease expired\r\n\tat org.springframework.vault.core.lease.SecretLeaseContainer.doRenewLease(SecretLeaseContainer.java:604) [spring-vault-core-2.1.1.BUILD-20181010.071554-4.jar:2.1.1.BUILD-SNAPSHOT]\r\n\tat org.springframework.vault.core.lease.SecretLeaseContainer.lambda$scheduleLeaseRenewal$0(SecretLeaseContainer.java:503) [spring-vault-core-2.1.1.BUILD-20181010.071554-4.jar:2.1.1.BUILD-SNAPSHOT]\r\n\tat org.springframework.vault.core.lease.SecretLeaseContainer$LeaseRenewalScheduler$1.run(SecretLeaseContainer.java:776) ~[spring-vault-core-2.1.1.BUILD-20181010.071554-4.jar:2.1.1.BUILD-SNAPSHOT]\r\n\tat org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54) ~[spring-context-5.0.10.RELEASE.jar:5.0.10.RELEASE]\r\n\tat org.springframework.scheduling.concurrent.ReschedulingRunnable.run(ReschedulingRunnable.java:93) ~[spring-context-5.0.10.RELEASE.jar:5.0.10.RELEASE]\r\n\tat java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[na:1.8.0_152]\r\n\tat java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[na:1.8.0_152]\r\n\tat java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) ~[na:1.8.0_152]\r\n\tat java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) ~[na:1.8.0_152]\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_152]\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_152]\r\n\tat java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_152]\r\n```\r\nAnd error message also shows from vault server:\r\n```\r\n2018-10-25T22:11:26.607+0800 [ERROR] secrets.system.system_79b963f3: lease renewal failed: lease_id=database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V error=\"lease expired\"\r\n2018-10-25T22:11:26.690+0800 [INFO]  expiration: revoked lease: lease_id=database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V\r\n```\r\n\r\nBesides,  before the exception, there's some info of spring vault scheduling the renewal:\r\n```\r\n2018-10-25 22:10:26.506 DEBUG 5446 --- [           main] o.s.v.c.e.LeaseAwareVaultPropertySource  : Requesting secrets from Vault at database/creds/readwrite using RENEW\r\n2018-10-25 22:10:26.558 DEBUG 5446 --- [           main] o.s.v.core.lease.SecretLeaseContainer    : Secret database/creds/readwrite with Lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V qualified for renewal\r\n2018-10-25 22:10:26.559 DEBUG 5446 --- [           main] cretLeaseContainer$LeaseRenewalScheduler : Scheduling renewal for secret database/creds/readwrite with lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V, lease duration 60\r\n2018-10-25 22:10:36.561 DEBUG 5446 --- [g-Cloud-Vault-1] cretLeaseContainer$LeaseRenewalScheduler : Renewing lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6Vfor secret database/creds/readwrite\r\n2018-10-25 22:10:36.570 DEBUG 5446 --- [g-Cloud-Vault-1] o.s.v.core.lease.SecretLeaseContainer    : Secret database/creds/readwrite with Lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V qualified for renewal\r\n2018-10-25 22:10:36.570 DEBUG 5446 --- [g-Cloud-Vault-1] cretLeaseContainer$LeaseRenewalScheduler : Scheduling renewal for secret database/creds/readwrite with lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V, lease duration 50\r\n2018-10-25 22:10:46.574 DEBUG 5446 --- [g-Cloud-Vault-2] cretLeaseContainer$LeaseRenewalScheduler : Renewing lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6Vfor secret database/creds/readwrite\r\n2018-10-25 22:10:46.578 DEBUG 5446 --- [g-Cloud-Vault-2] o.s.v.core.lease.SecretLeaseContainer    : Secret database/creds/readwrite with Lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V qualified for renewal\r\n2018-10-25 22:10:46.579 DEBUG 5446 --- [g-Cloud-Vault-2] cretLeaseContainer$LeaseRenewalScheduler : Scheduling renewal for secret database/creds/readwrite with lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V, lease duration 40\r\n2018-10-25 22:10:56.579 DEBUG 5446 --- [g-Cloud-Vault-1] cretLeaseContainer$LeaseRenewalScheduler : Renewing lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6Vfor secret database/creds/readwrite\r\n2018-10-25 22:10:56.585 DEBUG 5446 --- [g-Cloud-Vault-1] o.s.v.core.lease.SecretLeaseContainer    : Secret database/creds/readwrite with Lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V qualified for renewal\r\n2018-10-25 22:10:56.585 DEBUG 5446 --- [g-Cloud-Vault-1] cretLeaseContainer$LeaseRenewalScheduler : Scheduling renewal for secret database/creds/readwrite with lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V, lease duration 30\r\n2018-10-25 22:11:06.587 DEBUG 5446 --- [g-Cloud-Vault-2] cretLeaseContainer$LeaseRenewalScheduler : Renewing lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6Vfor secret database/creds/readwrite\r\n2018-10-25 22:11:06.592 DEBUG 5446 --- [g-Cloud-Vault-2] o.s.v.core.lease.SecretLeaseContainer    : Secret database/creds/readwrite with Lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V qualified for renewal\r\n2018-10-25 22:11:06.592 DEBUG 5446 --- [g-Cloud-Vault-2] cretLeaseContainer$LeaseRenewalScheduler : Scheduling renewal for secret database/creds/readwrite with lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V, lease duration 20\r\n2018-10-25 22:11:16.596 DEBUG 5446 --- [g-Cloud-Vault-1] cretLeaseContainer$LeaseRenewalScheduler : Renewing lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6Vfor secret database/creds/readwrite\r\n2018-10-25 22:11:16.600 DEBUG 5446 --- [g-Cloud-Vault-1] o.s.v.core.lease.SecretLeaseContainer    : Secret database/creds/readwrite with Lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V qualified for renewal\r\n2018-10-25 22:11:16.600 DEBUG 5446 --- [g-Cloud-Vault-1] cretLeaseContainer$LeaseRenewalScheduler : Scheduling renewal for secret database/creds/readwrite with lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6V, lease duration 10\r\n2018-10-25 22:11:26.603 DEBUG 5446 --- [g-Cloud-Vault-2] cretLeaseContainer$LeaseRenewalScheduler : Renewing lease database/creds/readwrite/RARStXyFlVRqfABSVobZUH6Vfor secret database/creds/readwrite\r\n201\r\n```\r\n\r\nI'm using the version of `2.1.1.BUILD-SNAPSHOT` because before the version I got 403 forbidden error when renewing the secret just as [the question](https://stackoverflow.com/questions/50154923/what-policy-required-to-renew-database-lease) and [the issue #255 ](https://github.com/spring-cloud/spring-cloud-vault/issues/255) described, and using the version according to the comment in #255 . However, it seems the problem reported in [spring vault #319](https://github.com/spring-projects/spring-vault/issues/319) still occurs in spring cloud vault."},"comment":{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/issues/comments/433586048","html_url":"https://github.com/spring-cloud/spring-cloud-vault/issues/256#issuecomment-433586048","issue_url":"https://api.github.com/repos/spring-cloud/spring-cloud-vault/issues/256","id":433586048,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzU4NjA0OA==","user":{"login":"tonny1983","id":8895687,"node_id":"MDQ6VXNlcjg4OTU2ODc=","avatar_url":"https://avatars2.githubusercontent.com/u/8895687?v=4","gravatar_id":"","url":"https://api.github.com/users/tonny1983","html_url":"https://github.com/tonny1983","followers_url":"https://api.github.com/users/tonny1983/followers","following_url":"https://api.github.com/users/tonny1983/following{/other_user}","gists_url":"https://api.github.com/users/tonny1983/gists{/gist_id}","starred_url":"https://api.github.com/users/tonny1983/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tonny1983/subscriptions","organizations_url":"https://api.github.com/users/tonny1983/orgs","repos_url":"https://api.github.com/users/tonny1983/repos","events_url":"https://api.github.com/users/tonny1983/events{/privacy}","received_events_url":"https://api.github.com/users/tonny1983/received_events","type":"User","site_admin":false},"created_at":"2018-10-27T03:09:47Z","updated_at":"2018-10-27T03:09:47Z","author_association":"NONE","body":"I got it. And may I have just one more further question please? How about the secret id when it reaches the TTL? Should I also take charge to control the rotation of secret id?"}}
{"actor":{"display_login":"tonny1983"}}