An application is trying to use a dynamic secret in which the lease has expired. What can be done in order for the application to successfully request data from Vault?
A.
Try the expired secret in hopes it hasn’t been deleted yet
Once a dynamic secret’s lease expires, it cannot be renewed or reused; a new secret must be requested. The HashiCorp Vault documentation states: "A lease must be renewed before it has expired. Once it has expired, it is permanently revoked and a new secret must be requested." This means that after expiration, the secret is invalidated, and the application must obtain a new secret with a new lease to regain access.
Trying an expired secret (A) is futile as it’s revoked. Performing a lease renewal (B) is impossible post-expiration, as the docs note: "Renewal must occur before the lease expires." Extending the TTL (D) isn’t an option for an expired lease. Thus, C is the correct action.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit