sidecar{,-rs}: cleanup lease directories on start

the primary crash scenario for the sidecar is if for whatever reason a stale lease is found. we crash out without cleaning up the stale lease, leading to a crashloop when it is checked again.

clear the lease directories on start for a fresh slate.

Author: ewdurbin

containers/sidecar-rs/src/main.rs

@@ -397,6 +397,16 @@ fn vault_fetch_consul_token(
     Ok(())
 }
 
+fn clear_leases_dir(leases_dir: &Path) -> Result<()> {
+    for entry in fs::read_dir(leases_dir)?.flatten() {
+        if entry.file_type().map(|t| t.is_file()).unwrap_or(false) {
+            eprintln!("Removing old lease file: {}", entry.file_name().to_string_lossy());
+            fs::remove_file(entry.path())?;
+        }
+    }
+    Ok(())
+}
+
 // --- Shared command logic ---
 
 #[allow(clippy::too_many_arguments)]
@@ -446,7 +456,14 @@ fn do_kube_login(
     }
 
     let vault_secrets = Path::new(vault_secrets_path);
-    fs::create_dir_all(vault_secrets.join("leases"))?;
+    let lease_dirs: HashSet<PathBuf> = [vault_secrets_path, consul_secrets_path, cert_dir]
+        .iter()
+        .map(|p| Path::new(p).join("leases"))
+        .collect();
+    for lease_dir in &lease_dirs {
+        fs::create_dir_all(lease_dir)?;
+        clear_leases_dir(lease_dir)?;
+    }
 
     let jwt = fs::read_to_string("/var/run/secrets/kubernetes.io/serviceaccount/token")
         .context("reading kubernetes service account token")?;
@@ -492,7 +509,6 @@ fn do_kube_login(
 
     if fetch_consul_token {
         let consul_path = Path::new(consul_secrets_path);
-        fs::create_dir_all(consul_path.join("leases"))?;
         vault_fetch_consul_token(
             client,
             vault_addr,
@@ -505,7 +521,6 @@ fn do_kube_login(
 
     if fetch_cert {
         let cert_path = Path::new(cert_dir);
-        fs::create_dir_all(cert_path.join("leases"))?;
         vault_fetch_certificate(
             client,
             vault_addr,

containers/sidecar/sidecar.py

@@ -364,6 +364,14 @@ def vault_fetch_consul_token(
     write_consul_token(consul_secrets_path, consul_token_response.json())
 
 
+def _clear_leases_dir(leases_dir):
+    for entry in os.listdir(leases_dir):
+        path = os.path.join(leases_dir, entry)
+        if os.path.isfile(path):
+            click.echo(f"Removing old lease file: {entry}")
+            os.remove(path)
+
+
 # --- Shared logic for CLI commands ---
 
 
@@ -419,7 +427,12 @@ def do_kube_login(
             "                        unwrapped token must be accessible during bootstrap"
         )
 
-    os.makedirs(os.path.join(vault_secrets_path, "leases"), exist_ok=True)
+    for lease_dir in set(
+        os.path.join(x, "leases")
+        for x in [vault_secrets_path, consul_secrets_path, cert_dir]
+    ):
+        os.makedirs(lease_dir, exist_ok=True)
+        _clear_leases_dir(lease_dir)
     with open("/var/run/secrets/kubernetes.io/serviceaccount/token", "r") as token_file:
         jwt = token_file.read()
 
@@ -452,7 +465,6 @@ def do_kube_login(
             vault_token_file.write(token_contents)
 
     if fetch_consul_token:
-        os.makedirs(os.path.join(consul_secrets_path, "leases"), exist_ok=True)
         vault_fetch_consul_token(
             vault_addr,
             token_contents,
@@ -462,7 +474,6 @@ def do_kube_login(
             consul_secrets_path,
         )
     if fetch_cert:
-        os.makedirs(os.path.join(cert_dir, "leases"), exist_ok=True)
         vault_fetch_certificate(
             vault_addr,
             token_contents,