Skip to content

vault: add a retry for non fatal token renewals - #27947

Merged
mismithhisler merged 6 commits into
mainfrom
b-fix-vault-renew-retry
May 20, 2026
Merged

mismithhisler merged 6 commits into
mainfrom
b-fix-vault-renew-retry

Conversation

@mismithhisler

@mismithhisler mismithhisler commented May 11, 2026 •

Copy link
Copy Markdown
Member

Description

The current vault token renewal logic tries to renew at 1/2 token TTL. If a non fatal error occurs (like network connectivity problems), the next retry is at another 1/2 TTL, which is the entire TTL. So it's likely that the token is expired by that time. These changes update that retry to be once per minute. This is a temporary fix until a subsequent PR refactors the vault client renewal process and includes proper exponential back-off retries.

Testing & Reproduction steps

Links

Fixes: #27920

Contributor Checklist

  • Changelog Entry If this PR changes user-facing behavior, please generate and add a
    changelog entry using the make cl command.
  • Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
    ensure regressions will be caught.
  • Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
    and job configuration, please update the Nomad product documentation, which is stored in the
    web-unified-docs repo. Refer to the web-unified-docs contributor guide for docs guidelines.
    Please also consider whether the change requires notes within the upgrade
    guide
    . If you would like help with the docs, tag the nomad-docs team in this PR.

Reviewer Checklist

  • Backport Labels Please add the correct backport labels as described by the internal
    backporting document.
  • Commit Type Ensure the correct merge method is selected which should be "squash and merge"
    in the majority of situations. The main exceptions are long-lived feature branches or merges where
    history should be preserved.
  • Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
    within the public repository.
  • If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

@mismithhisler mismithhisler self-assigned this May 11, 2026
@mismithhisler
mismithhisler requested review from a team as code owners May 11, 2026 23:25
Comment thread client/vaultclient/vaultclient.go Outdated
Co-authored-by: Tim Gross <tgross@hashicorp.com>

@pkazmierczak pkazmierczak left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mismithhisler mismithhisler added backport/ent/1.10.x+ent backport to 1.10.x+ent release line backport/ent/1.11.x+ent backport to 1.11.x+ent release line labels May 20, 2026
@mismithhisler
mismithhisler merged commit a6c35c0 into main May 20, 2026
43 checks passed
@mismithhisler
mismithhisler deleted the b-fix-vault-renew-retry branch May 20, 2026 15:10
schmichael pushed a commit to vercel/nomad that referenced this pull request Sep 25, 2026
---------

Co-authored-by: Tim Gross <tgross@hashicorp.com>
@github-actions

Copy link
Copy Markdown

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Sep 26, 2026

This branch was successfully deployed

1 active deployment
Preview — ca8d2871 Deployed May 18, 2026 by vercel[bot]
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

backport/ent/1.10.x+ent backport to 1.10.x+ent release line backport/ent/1.11.x+ent backport to 1.11.x+ent release line backport/2.0.x backport to 2.0.x release line

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vault token renew time

3 participants