auth token expired mid-vault-rotation for the secrets agent: auth error
Handles an auth token expiring mid-Vault-rotation for a secrets agent: renew before TTL and re-auth on 403. Use when long rotations outlive tokens. Not for permission errors.
TL;DR
Rotations longer than the token TTL die mid-run. Renew the token on a schedule inside its TTL, and on auth failures, re-authenticate and resume from the last completed step.
Error
auth token expired mid-vault-rotation for the secrets agent: auth errorSteps
- Confirm expiry: the token worked at start and fails later with auth errors. Expected: expiry proven.
- Add renewal at a fraction of the TTL during long runs. Expected: the token stays alive.
- On 403 mid-run, re-authenticate, then reconcile state before continuing. Expected: clean resume.
- Make rotation steps idempotent so resume is safe. Expected: no double-apply.
- Size token TTLs to the longest expected rotation. Expected: margin.
When to use
- Vault rotations dying on token expiry.
- Long-running authenticated agents.
When not to use
- Permission errors (policy issue).
- Tokens invalid from the start (fix auth).
Tool compatibility
- Vault token TTLs and renewal; agent rotation loops.
Variant phrasings
vault token expired mid rotation
Renew and resume.
auth failed halfway through rotation
Re-auth, reconcile.
Why it happens
Tokens are time-bound; rotations are not. Any rotation longer than the TTL hits the boundary.
Edge cases
- Renewal itself needs permission; check the token can renew itself.
- Max TTL caps renewal; some rotations need fresh tokens, not renewals.
- Resume must verify state; blind continuation risks gaps.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_60NZIQWz2XnrGUuxfbgTBw