-
Notifications
You must be signed in to change notification settings - Fork 4.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Documentation to include lease_threshold_renewal clarity #28943
base: main
Are you sure you want to change the base?
Conversation
Also updated to include PKICert documentation that shows using "writetoFile" such that practitioners can reference it while using it for the Vault Agent
engine should wait to refresh dynamic, non-renewable leases, measured as | ||
a fraction of the lease duration. For certificates rendered using the `pkiCert` | ||
template function without leases, the `Not After` attribute is treated as the | ||
lease end time, and the certificate will rotate at 70% of the difference between |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
and the certificate will rotate at 70%
Is the 70% related to this configuration at all? For example, by default, this is set to 0.9, would it be 90% by default?
Co-authored-by: Violet Hynes <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
updated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me! Thanks for this :)
Also updated to include PKICert documentation that shows using "writetoFile" such that practitioners can reference it while using it for the Vault Agent
Description
What does this PR do?
TODO only if you're a HashiCorp employee
backport/
label that matches the desired release branch. Note that in the CE repo, the latest release branch will look likebackport/x.x.x
, but older release branches will bebackport/ent/x.x.x+ent
.of a public function, even if that change is in a CE file, double check that
applying the patch for this PR to the ENT repo and running tests doesn't
break any tests. Sometimes ENT only tests rely on public functions in CE
files.
in the PR description, commit message, or branch name.
description. Also, make sure the changelog is in this PR, not in your ENT PR.