{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/6659","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/6659/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/6659/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/6659/events","html_url":"https://github.com/hashicorp/vault/issues/6659","id":438929597,"node_id":"MDU6SXNzdWU0Mzg5Mjk1OTc=","number":6659,"title":"Vault Agent is revoking periodic tokens at system/mountpoint max_ttl","user":{"login":"danlsgiga","id":1944846,"node_id":"MDQ6VXNlcjE5NDQ4NDY=","avatar_url":"https://avatars2.githubusercontent.com/u/1944846?v=4","gravatar_id":"","url":"https://api.github.com/users/danlsgiga","html_url":"https://github.com/danlsgiga","followers_url":"https://api.github.com/users/danlsgiga/followers","following_url":"https://api.github.com/users/danlsgiga/following{/other_user}","gists_url":"https://api.github.com/users/danlsgiga/gists{/gist_id}","starred_url":"https://api.github.com/users/danlsgiga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danlsgiga/subscriptions","organizations_url":"https://api.github.com/users/danlsgiga/orgs","repos_url":"https://api.github.com/users/danlsgiga/repos","events_url":"https://api.github.com/users/danlsgiga/events{/privacy}","received_events_url":"https://api.github.com/users/danlsgiga/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"calvn","id":1883212,"node_id":"MDQ6VXNlcjE4ODMyMTI=","avatar_url":"https://avatars0.githubusercontent.com/u/1883212?v=4","gravatar_id":"","url":"https://api.github.com/users/calvn","html_url":"https://github.com/calvn","followers_url":"https://api.github.com/users/calvn/followers","following_url":"https://api.github.com/users/calvn/following{/other_user}","gists_url":"https://api.github.com/users/calvn/gists{/gist_id}","starred_url":"https://api.github.com/users/calvn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calvn/subscriptions","organizations_url":"https://api.github.com/users/calvn/orgs","repos_url":"https://api.github.com/users/calvn/repos","events_url":"https://api.github.com/users/calvn/events{/privacy}","received_events_url":"https://api.github.com/users/calvn/received_events","type":"User","site_admin":false},"assignees":[{"login":"calvn","id":1883212,"node_id":"MDQ6VXNlcjE4ODMyMTI=","avatar_url":"https://avatars0.githubusercontent.com/u/1883212?v=4","gravatar_id":"","url":"https://api.github.com/users/calvn","html_url":"https://github.com/calvn","followers_url":"https://api.github.com/users/calvn/followers","following_url":"https://api.github.com/users/calvn/following{/other_user}","gists_url":"https://api.github.com/users/calvn/gists{/gist_id}","starred_url":"https://api.github.com/users/calvn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calvn/subscriptions","organizations_url":"https://api.github.com/users/calvn/orgs","repos_url":"https://api.github.com/users/calvn/repos","events_url":"https://api.github.com/users/calvn/events{/privacy}","received_events_url":"https://api.github.com/users/calvn/received_events","type":"User","site_admin":false}],"milestone":null,"comments":22,"created_at":"2019-04-30T19:03:24Z","updated_at":"2019-05-02T19:02:20Z","closed_at":"2019-05-02T19:02:20Z","author_association":"CONTRIBUTOR","body":"Vault agent works nicely on managing renewal of tokens and leases. But it does not manage to create a new token once the one it has expires due to the default vault max_ttl of 32 days. I'm using the AWS Auth secret engine and even setting the roles with `max_ttl=0` and `periodic=4hr`, the token still expires when the 32 default max_ttl is reached. Right now we have a workaround to restart the vault agent service but it would be nice to have it handling that scenario.\r\n\r\n**Describe the solution you'd like**\r\nOnce the token is about to expire due to its max_ttl, create a new one and manage its renewal lifecycle without requiring a service restart. \r\n\r\nAlso, it would be nice to have a hook to execute a command whenever that happens so we can automate requesting new Consul ACLs via Vault and updating them accordingly via Consul API. It would basically be the same behaviour that consul-template would have when a value changes on consul where you have an optional command to run after the new template is rendered.\r\n\r\n**Describe alternatives you've considered**\r\nAlternatives are basically out-of-band processes like restarting the daemon to force a new token creation\r\n\r\n**Additional context**\r\nWe can potentially extend the `max_ttl` setting of Vault globally or the mountpoint. But this sounds dirty and goes totally against the value of having Vault."}}
{"actor":{"display_login":"calvn"}}