3 ms·
We do something very similar, tho we don't use JWT, just a token, and store the userID in the KV store. How do you handle cleaning up the vault KV store? We ha
by zie 9y ago
We do something very similar, tho we don't use JWT, just a token, and store the userID in the KV store.
How do you handle cleaning up the vault KV store?
We have a separate process that runs around cleaning up old tokens, but am open to a better way.
- ah- 9y agoVault does the expiration/cleaning up for you.
- zie 9y agoYou are mistaken: "Even will a ttl set, the secrets engine never removes data on its own. The ttl key is merely advisory." - https://www.vaultproject.io/docs/secrets/kv/index.html https://www.vaultproject.io/docs/secrets/kv/index.html
- matyix 9y agoWhich storage backend are you using for Vault? With MySql you could use scheduled events (no need to run/manage your own process), a created_at column in the Vault table and a scheduled check for created_at+ttl and have the DB to remove the tokens once the lease is expired. Also, if you were to use an etcd backend you could configure it to have it removed once the lease is expired. The only drawback is that the tokens TTL's are global and you can't set per user.