[WIP] Vault Eventing: Instant Secret Updates for Static and Dynamic roles. - #1295
Draft
Balaji2198 wants to merge 11 commits into
Draft
[WIP] Vault Eventing: Instant Secret Updates for Static and Dynamic roles.#1295Balaji2198 wants to merge 11 commits into
Balaji2198 wants to merge 11 commits into
Conversation
siyer-corp
force-pushed
the
VAULT-42860/optimize-websockets
branch
from
July 1, 2026 07:32
21aba44 to
8d23599
Compare
* Enable instant updates for VDS * Fix lease based events * Fix Dynamic Secrets Integration tests. (#1279) * Add rotation period to instant updates test assertions. * Update VaultAuth configuration in instant updates test for dynamic secrets. * Add db-events policy for database subscription capabilities. * Refactor database policies to conditionally include event handling based on use_events variable. * Add Instant updates integration tests (#1282) * Add rotation period to instant updates test assertions. * Update VaultAuth configuration in instant updates test for dynamic secrets. * Add db-events policy for database subscription capabilities. * Add lease event subscriptions and dynamic credential update test for instant updates. * Refine instant updates test to focus on lease ID changes and remove unnecessary SecretMAC checks. * Increase retry limit for instant updates dynamic credentials test to 60 seconds. * Add integration test for instant updates watcher restart on VaultAuth change. * Refactor instant updates integration tests. * Refactor instant updates test to create separate VaultAuth instances for each subtest. * Refactor integration tests for instant updates in VaultDynamicSecret. * Update instant updates test to extend lease TTL and assertion window. * Update instant updates tests to handle cluster name based on scale test condition. * Update policy for DynamicCreds test * Update db-events policy to include additional capabilities and event types. * Update policy db-with-events * Skip instant updates test for Vault versions below 2.0 due to WebSocket event requirements. * Add X-Vault-Index Header Support for Stale-Read Protection and Event Reconciliation (#1285) * Add support for X-Vault-Index header in Vault requests to ensure stale-read protection. - Introduced HeaderVaultIndex for conditional forwarding on Performance Standbys. - Enhanced event subscription logic to store vault_index for subsequent reconciliations. - Added tests to verify correct handling of X-Vault-Index in various scenarios. * Add support for custom headers in MockRecordingVaultClient Write method. * Add tests for X-Vault-Index header handling in Vault reconciler. * Add Changelog and update API reference doc. * Update manifests files for the CRD changes. * Refactor tests to use vsoconsts for vault index constants in static and dynamic secret reconciler tests. * Reword TestVaultDynamicSecret_InstantUpdates description. --------- Co-authored-by: Balaji <balaji.b@hashicorp.com>
…bscribers. (#1305) * Add Prometheus metrics for active event watchers in Vault controllers. * Add WebSocket metrics to monitor active connections and subscribers.
siyer-corp
changed the title
* Code added for requeue event once even loop exit, registry cleanup and orphaned registry detection * Unit and integration tests added for requeueEvent, registry cleanup and orphaned registry detection * Apply gofumpt formatting * Removing parallel run of VSS registry tests * Code added to close dead WebSocket before removal in getOrCreateWebSocket * Code added to replace infinite retry with errorCount threshold in eventLoop * Code modified to provide threshold for connection retry and recreate shared websocket after reconnect failure threshold is reached * Requeue event, registry cleanup and orphan entry code added in VDS+VSS along with testcases * Test added for vaultDynamicSecret in event_watcher_registry_test.go * Comments updated * Fixed WebSocket stop-notification ordering, atomicity, and delivery; eliminated subscriber double-delete race; narrowed the Client interface; deduplicated subscriber code; closed orphan detection gaps; and cleaned up tests.
* Perf: Parallelize VDS instant update integration tests. * refactor: extract helper funcs for VDS instant update tests. * Add await event watcher started before triggering rotation. * Perf: Optimize Scale testing Infra for VDS. (#1317) * perf: Share infra across parallel instant-update subtests. * perf: Optimize Scale testing Infra for VDS Dynamic. * Snapshot vds baseline before awaiting watcher start.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PCI review checklist
I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.