Skip renewal for non-renewable Vault tokens #9208
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ng renewal Signed-off-by: IvanChalukov <ichalukov@gmail.com>
Kump3r
approved these changes
May 27, 2025
There was a problem hiding this comment.
I tested the implementation with both Batch and service tokens:
batchtokens are skipped after the lookup and never try to be renewed. After restart of the web additional lookup is done for each token, but again only once and no renew requests are doneservicetokens continue to work as before and we see a successful renew info log in the output logs. No further requests are made until the time duration requires a new retry request.
We haven't executed any integration/unit tests as we failed to find such. Let us know if we just missed them and they need to be addressed.
Good job @IvanChalukov and thanks for the PR!
taylorsilva
approved these changes
Jun 23, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes proposed by this PR
This PR, developed in collaboration with @Kump3r, addresses scenarios where Vault tokens cannot be self-renewed, such as Batch tokens. In our environment, over 2,000 pipelines across 60 teams use Batch Vault tokens to collect information. This results in millions of renewal attempts each month, all of which fail because Batch tokens are non-renewable.
Notes to reviewer
Service tokens and Batch tokens comparison could be found in Token type comparison
Release Note