legion-crypt 1.5.12 → 1.5.37

data/lib/legion/crypt/mtls.rb

@@ -33,12 +33,9 @@ module Legion
           resolved_ttl = ttl || cert_ttl_setting || DEFAULT_TTL
           log.info "[mTLS] certificate issue requested common_name=#{common_name} ttl=#{resolved_ttl}"
 
-          response = ::Vault.logical.write(
-            pki_path,
-            common_name: common_name,
-            ttl:         resolved_ttl,
-            ip_sans:     local_ip,
-            alt_names:   ''
+          response = Legion::Crypt.vault_client.logical.write(
+            path: pki_path,
+            data: { common_name: common_name, ttl: resolved_ttl, ip_sans: local_ip, alt_names: '' }
           )
 
           raise "Vault PKI returned nil for #{pki_path} (common_name=#{common_name})" if response.nil?

data/lib/legion/crypt/partition_keys.rb

@@ -41,6 +41,8 @@ module Legion
         end
 
         def decrypt_for_tenant(ciphertext:, init_vector:, auth_tag:, tenant_id:, master_key:)
+          raise ArgumentError, 'invalid GCM authentication tag length' unless auth_tag.is_a?(String) && auth_tag.bytesize == 16
+
           key = derive_key(master_key: master_key, tenant_id: tenant_id)
           decipher = OpenSSL::Cipher.new('aes-256-gcm')
           decipher.decrypt

data/lib/legion/crypt/settings.rb

@@ -55,7 +55,7 @@ module Legion
 
       def self.vault
         {
-          enabled:             !Gem::Specification.find_by_name('vault').nil?,
+          enabled:             true,
           protocol:            'http',
           address:             'localhost',
           port:                8200,
@@ -63,6 +63,7 @@ module Legion
           connected:           false,
           renewer_time:        5,
           renewer:             true,
+          operation_timeout:   5,
           push_cluster_secret: false,
           read_cluster_secret: false,
           kv_path:             ENV['LEGION_VAULT_KV_PATH'] || 'legion',

data/lib/legion/crypt/spiffe/workload_api_client.rb

@@ -3,6 +3,7 @@
 require 'legion/logging/helper'
 require 'socket'
 require 'openssl'
+require 'timeout'
 
 module Legion
   module Crypt
@@ -14,9 +15,8 @@ module Legion
       # a full gRPC stack by implementing just enough of the HTTP/2 framing to
       # send a single unary RPC call and parse a single response.
       #
-      # For environments that cannot make a real SPIRE call (CI, lite mode,
-      # no socket present) the client returns a self-signed fallback SVID so
-      # that callers never have to special-case the nil case.
+      # X.509 fallback is available only when explicitly enabled; otherwise
+      # unavailable or invalid Workload API responses fail closed.
       class WorkloadApiClient
         include Legion::Logging::Helper
 
@@ -40,7 +40,7 @@ module Legion
 
         # Fetch an X.509 SVID from the SPIRE Workload API.
         # Returns a populated X509Svid struct.
-        # Falls back to a self-signed certificate when the Workload API is unavailable.
+        # Uses a self-signed fallback only when explicitly enabled.
         def fetch_x509_svid
           log.info("[SPIFFE] Fetching X.509 SVID from Workload API socket=#{@socket_path}")
           raw = call_workload_api(FETCH_X509_METHOD, '')
@@ -82,11 +82,13 @@ module Legion
 
         # Returns true when the SPIRE agent socket exists and is reachable.
         def available?
-          return false unless ::File.exist?(@socket_path)
+          with_socket_deadline(deadline: ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + CONNECT_TIMEOUT) do
+            return false unless ::File.exist?(@socket_path)
 
-          sock = UNIXSocket.new(@socket_path)
-          sock.close
-          true
+            sock = UNIXSocket.new(@socket_path)
+            sock.close
+            true
+          end
         rescue StandardError => e
           handle_exception(e, level: :debug, operation: 'crypt.spiffe.workload_api_client.available',
                            socket_path: @socket_path)
@@ -96,16 +98,28 @@ module Legion
         private
 
         # Minimal HTTP/2 + gRPC unary call over a Unix domain socket.
-        # This is intentionally simple: one request frame, one response frame.
+        # One bounded request; response DATA frames may split a gRPC message.
         def call_workload_api(method_path, request_body)
           log.debug("[SPIFFE] Calling Workload API method=#{method_path}")
-          sock = connect_socket
-          begin
-            send_grpc_request(sock, method_path, request_body)
-            read_grpc_response(sock)
-          ensure
-            close_workload_api_socket(sock, method_path)
+          deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + READ_TIMEOUT
+          sock = nil
+          with_socket_deadline(deadline: deadline) do
+            connect_deadline = [deadline, ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + CONNECT_TIMEOUT].min
+            with_socket_deadline(deadline: connect_deadline) do
+              raise WorkloadApiError, "SPIRE agent socket not found at '#{@socket_path}'" unless ::File.exist?(@socket_path)
+
+              sock = UNIXSocket.new(@socket_path)
+              sock.write(HTTP2_PREFACE)
+              sock.write(HTTP2_SETTINGS_FRAME)
+              sock.flush
+              send_grpc_request(sock, method_path, request_body)
+            end
+            read_grpc_response(sock, deadline: deadline)
           end
+        rescue Errno::EACCES => e
+          raise WorkloadApiError, "Cannot connect to SPIRE agent socket: #{e.message}"
+        ensure
+          close_workload_api_socket(sock, method_path) if sock
         end
 
         def close_workload_api_socket(sock, method_path)
@@ -116,23 +130,13 @@ module Legion
           nil
         end
 
-        def connect_socket
-          raise WorkloadApiError, "SPIRE agent socket not found at '#{@socket_path}'" unless ::File.exist?(@socket_path)
+        def with_socket_deadline(deadline:, **, &)
+          remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+          raise WorkloadApiError, 'Workload API operation timed out' unless remaining.positive?
 
-          sock = UNIXSocket.new(@socket_path)
-          # Write HTTP/2 connection preface and initial SETTINGS frame.
-          sock.write(HTTP2_PREFACE)
-          sock.write(HTTP2_SETTINGS_FRAME)
-          sock.flush
-          sock
-        rescue Errno::ENOENT => e
-          handle_exception(e, level: :debug, operation: 'crypt.spiffe.workload_api_client.connect_socket',
-                           socket_path: @socket_path)
-          raise WorkloadApiError, "SPIRE agent socket not found at '#{@socket_path}'"
-        rescue Errno::ECONNREFUSED, Errno::EACCES => e
-          handle_exception(e, level: :debug, operation: 'crypt.spiffe.workload_api_client.connect_socket',
-                           socket_path: @socket_path)
-          raise WorkloadApiError, "Cannot connect to SPIRE agent socket: #{e.message}"
+          Timeout.timeout(remaining, &)
+        rescue Timeout::Error
+          raise WorkloadApiError, 'Workload API operation timed out'
         end
 
         # Build and send a minimal gRPC/HTTP2 HEADERS + DATA frame.
@@ -195,61 +199,58 @@ module Legion
             payload.b
         end
 
-        def read_grpc_response(sock)
-          # Read until we see a DATA frame containing a gRPC message or timeout.
-          deadline = Time.now + READ_TIMEOUT
-          buffer   = ''.b
-
+        def read_grpc_response(sock, deadline:)
+          buffer = ''.b
+          message = ''.b
           loop do
-            raise WorkloadApiError, 'Workload API read timeout' if Time.now > deadline
-
-            ready = sock.wait_readable(1.0)
-            next unless ready
+            remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+            raise WorkloadApiError, 'Workload API read timeout' unless remaining.positive?
+            next unless sock.wait_readable(remaining)
 
             chunk = sock.read_nonblock(4096, exception: false)
-            break if chunk == :wait_readable || chunk.nil?
+            next if chunk == :wait_readable
+            break if chunk.nil?
 
-            buffer += chunk.b
-            result  = extract_grpc_body(buffer)
-            return result if result
+            buffer << chunk
+            result = extract_grpc_body(buffer, message: message)
+            return result unless result.nil?
           end
 
           raise WorkloadApiError, 'No valid gRPC response received from Workload API'
         end
 
-        # Scan the raw HTTP/2 buffer for a DATA frame (type=0x00) that contains
-        # a non-empty gRPC message and return the message body bytes.
-        def extract_grpc_body(buffer)
+        # Consume complete HTTP/2 frames and accumulate stream 1 DATA bytes.
+        # The gRPC prefix and body can each span multiple frames and reads.
+        def extract_grpc_body(buffer, message:)
           pos = 0
           while pos + 9 <= buffer.bytesize
             frame_length = (buffer.getbyte(pos) << 16) | (buffer.getbyte(pos + 1) << 8) | buffer.getbyte(pos + 2)
-            frame_type   = buffer.getbyte(pos + 3)
-            pos         += 9 # skip frame header
-
-            if pos + frame_length > buffer.bytesize
-              # Incomplete frame — need more data.
-              return nil
+            frame_end = pos + 9 + frame_length
+            break if frame_end > buffer.bytesize
+
+            frame_type = buffer.getbyte(pos + 3)
+            flags = buffer.getbyte(pos + 4)
+            stream_id = buffer.unpack1('N', offset: pos + 5) & 0x7FFFFFFF
+            pos += 9
+            if frame_type.zero? && stream_id == 1
+              if flags.anybits?(0x08)
+                padding = buffer.getbyte(pos)
+                raise WorkloadApiError, 'Invalid padded HTTP/2 DATA frame' if frame_length.zero? || padding >= frame_length
+
+                pos += 1
+                frame_length -= padding + 1
+              end
+              message << buffer.byteslice(pos, frame_length)
             end
+            pos = frame_end
+            next if message.bytesize < 5
 
-            payload = buffer.byteslice(pos, frame_length)
-            pos    += frame_length
-
-            next unless frame_type.zero? && payload && payload.bytesize >= 5
-
-            # gRPC message: 1-byte compressed flag + 4-byte length + body
-            compressed = payload.getbyte(0)
-            msg_length = (payload.getbyte(1) << 24) | (payload.getbyte(2) << 16) |
-                         (payload.getbyte(3) << 8)  | payload.getbyte(4)
-            next if msg_length.zero?
-
-            msg_body = payload.byteslice(5, msg_length)
-            next if msg_body.nil? || msg_body.bytesize < msg_length
-
-            # Compressed gRPC responses are not expected from SPIRE; skip them.
-            next unless compressed.zero?
+            raise WorkloadApiError, 'Compressed gRPC responses are unsupported' unless message.getbyte(0).zero?
 
-            return msg_body
+            length = message.unpack1('N', offset: 1)
+            return message.byteslice(5, length) if message.bytesize >= length + 5
           end
+          buffer.slice!(0, pos) if pos.positive?
           nil
         end
 
@@ -258,7 +259,18 @@ module Legion
         def encode_jwt_request(audience)
           audience_bytes = audience.b
           # Field 1, wire type 2 (length-delimited) = tag 0x0A
-          "\n#{[audience_bytes.bytesize].pack('C')}#{audience_bytes}"
+          "\x0A".b + encode_varint(value: audience_bytes.bytesize) + audience_bytes
+        end
+
+        def encode_varint(value:, **)
+          bytes = ''.b
+          loop do
+            byte = value & 0x7F
+            value >>= 7
+            bytes << (value.zero? ? byte : byte | 0x80)
+            break if value.zero?
+          end
+          bytes
         end
 
         # Parse the raw protobuf bytes from FetchX509SVIDResponse into an X509Svid.

data/lib/legion/crypt/token_renewer.rb

@@ -2,6 +2,8 @@
 
 require 'legion/logging/helper'
 require 'legion/crypt/kerberos_auth'
+require 'legion/crypt/vault_operation'
+require 'legion/crypt/vault_client'
 
 module Legion
   module Crypt
@@ -12,6 +14,7 @@ module Legion
       MAX_BACKOFF     = 600
       MIN_SLEEP       = 30
       RENEWAL_RATIO   = 0.75
+      MINIMUM_WAIT = 0.01
 
       attr_reader :cluster_name
 
@@ -22,59 +25,131 @@ module Legion
         @thread       = nil
         @stop         = false
         @backoff      = INITIAL_BACKOFF
+        @state_mutex  = Mutex.new
+        @wake         = ConditionVariable.new
+        @generation   = 0
+        @stopping     = false
+        ttl = config[:lease_duration].to_f
+        @expires_at = config[:expires_at] || (Time.now + ttl if ttl.positive?)
+        @renewal_terminal = false
       end
 
       def start
-        return if running?
+        @state_mutex.synchronize do
+          return if @stopping || @thread&.alive? || crypt_stopping?
 
-        @stop = false
-        @thread = Thread.new { renewal_loop }
-        @thread.name = "vault-renewer-#{@cluster_name}"
+          @stop = false
+          @generation += 1
+          generation = @generation
+          @thread = Thread.new { renewal_loop(generation: generation) }
+          @thread.name = "vault-renewer-#{@cluster_name}"
+        end
         log.info("TokenRenewer[#{@cluster_name}]: token renewal thread started")
       end
 
-      def stop
-        @stop = true
-        @thread&.wakeup
-      rescue ThreadError => e
-        handle_exception(e, level: :debug, operation: 'crypt.token_renewer.stop', cluster_name: @cluster_name)
+      def request_stop
+        @state_mutex.synchronize do
+          @stop = true
+          @generation += 1
+          @wake.broadcast
+        end
         nil
-      ensure
-        stop_thread_and_revoke
+      end
+
+      def stop(deadline: nil)
+        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + VaultOperation::SHUTDOWN_TIMEOUT
+        @state_mutex.synchronize do
+          return if @stopping
+
+          @stopping = true
+        end
+
+        begin
+          request_stop
+          thread = @state_mutex.synchronize { @thread }
+          stop_thread_and_revoke(thread: thread, deadline: deadline)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'crypt.token_renewer.stop', cluster_name: @cluster_name)
+        ensure
+          @state_mutex.synchronize { @stopping = false }
+        end
       end
 
       def running?
-        @thread&.alive? == true
+        @state_mutex.synchronize { @thread&.alive? == true }
       end
 
-      def renew_token
-        result = @vault_client.auth_token.renew_self
-        @config[:lease_duration] = result.auth.lease_duration
-        @config[:renewable] = result.auth.renewable? if result.auth.respond_to?(:renewable?)
-        log.info("TokenRenewer[#{@cluster_name}]: token renewed, ttl=#{result.auth.lease_duration}s")
-        true
+      def renew_token(generation: nil)
+        generation ||= @state_mutex.synchronize { @generation }
+        return false unless @state_mutex.synchronize { active_generation?(generation: generation) }
+
+        deadline = @state_mutex.synchronize do
+          ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + (@expires_at - Time.now) if @expires_at
+        end
+        VaultOperation.with_timeout(deadline: deadline) do
+          result = @vault_client.auth_token.renew_self
+          @state_mutex.synchronize do
+            return false unless active_generation?(generation: generation)
+
+            @config[:lease_duration] = result.auth.lease_duration
+            @config[:renewable] = result.auth.renewable? if result.auth.respond_to?(:renewable?)
+            ttl = result.auth.lease_duration.to_f
+            @expires_at = ttl.positive? ? Time.now + ttl : nil
+            @config[:expires_at] = @expires_at
+            @config[:connected] = true
+            @config[:relogin_required] = false
+          end
+          log.info("TokenRenewer[#{@cluster_name}]: token renewed, ttl=#{result.auth.lease_duration}s")
+          true
+        end
       rescue StandardError => e
+        @state_mutex.synchronize do
+          if active_generation?(generation: generation) && @config[:auth_method].to_s != 'kerberos'
+            @renewal_terminal = e.is_a?(Legion::Crypt::Vault::HTTPClientError) && ![408, 429].include?(e.code)
+            if @renewal_terminal || (@expires_at && @expires_at <= Time.now)
+              @config[:connected] = false
+              @config[:relogin_required] = true
+            end
+          end
+        end
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.renew_token', cluster_name: @cluster_name)
         log.warn("TokenRenewer[#{@cluster_name}]: token renewal failed: #{e.message}")
         false
       end
 
-      def reauth_kerberos
-        krb_config = @config[:kerberos] || {}
-        result = Legion::Crypt::KerberosAuth.login(
-          vault_client:      @vault_client,
-          service_principal: krb_config[:service_principal],
-          auth_path:         krb_config[:auth_path] || KerberosAuth::DEFAULT_AUTH_PATH
-        )
+      def reauth_kerberos(generation: nil)
+        generation ||= @state_mutex.synchronize { @generation }
+        krb_config = @state_mutex.synchronize do
+          return false unless active_generation?(generation: generation)
+          return false unless @config[:auth_method].to_s == 'kerberos'
 
-        @config[:token]          = result[:token]
-        @config[:lease_duration] = result[:lease_duration]
-        @config[:renewable]      = result[:renewable]
-        @config[:connected]      = true
-        @vault_client.token      = result[:token]
-        log.info("TokenRenewer[#{@cluster_name}]: re-authenticated via Kerberos, ttl=#{result[:lease_duration]}s")
+          (@config[:kerberos] || {}).dup
+        end
+        active = lambda do |&mutation|
+          @state_mutex.synchronize do
+            next false unless active_generation?(generation: generation)
+
+            mutation&.call
+            true
+          end
+        end
+        VaultOperation.with_timeout do
+          result = Legion::Crypt::KerberosAuth.login(
+            vault_client:      @vault_client,
+            service_principal: krb_config[:service_principal],
+            auth_path:         krb_config[:auth_path] || KerberosAuth::DEFAULT_AUTH_PATH,
+            principal_guard:   active
+          )
 
-        reissue_all_leases
+          @state_mutex.synchronize do
+            return false unless active_generation?(generation: generation)
+
+            Legion::Crypt.publish_vault_grant(client: @vault_client, config: @config, grant: result, auth_method: 'kerberos')
+            @expires_at = @config[:expires_at]
+          end
+          log.info("TokenRenewer[#{@cluster_name}]: re-authenticated via Kerberos, ttl=#{result[:lease_duration]}s")
+        end
+        reissue_all_leases(active: active)
         true
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.reauth_kerberos', cluster_name: @cluster_name)
@@ -83,101 +158,156 @@ module Legion
       end
 
       def sleep_duration
-        lease_duration = @config[:lease_duration].to_i
-        duration = [(lease_duration * RENEWAL_RATIO).to_i, 1].max
-        return [duration, lease_duration - 1].min if lease_duration.positive? && lease_duration < MIN_SLEEP
+        @state_mutex.synchronize do
+          return MIN_SLEEP unless @expires_at
 
-        [duration, MIN_SLEEP].max
+          remaining = @expires_at - Time.now
+          renewable = @config[:renewable] || @config[:auth_method].to_s == 'kerberos'
+          delay = renewable ? remaining - (@config[:lease_duration].to_f * (1 - RENEWAL_RATIO)) : remaining
+          [delay, MINIMUM_WAIT].max
+        end
       end
 
-      def next_backoff
-        current = @backoff
-        @backoff = [@backoff * 2, MAX_BACKOFF].min
-        current
+      def next_backoff(generation: nil)
+        @state_mutex.synchronize do
+          return unless active_generation?(generation: generation || @generation)
+
+          current = @backoff
+          @backoff = [@backoff * 2, MAX_BACKOFF].min
+          current
+        end
       end
 
-      def reset_backoff
-        @backoff = INITIAL_BACKOFF
+      def reset_backoff(generation: nil)
+        @state_mutex.synchronize do
+          return unless active_generation?(generation: generation || @generation)
+
+          @backoff = INITIAL_BACKOFF
+        end
       end
 
       private
 
-      def renewal_loop
-        interruptible_sleep(sleep_duration)
+      def crypt_stopping?
+        Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
+      end
 
-        until @stop
-          if @config[:renewable]
-            if renew_token || reauth_kerberos
-              on_renewal_success
-            else
-              on_renewal_failure
-            end
+      def active_generation?(generation:, **)
+        !@stop && !crypt_stopping? && @generation == generation
+      end
+
+      def renewal_loop(generation:)
+        interruptible_sleep(sleep_duration, generation: generation)
+
+        loop do
+          policy = renewal_policy(generation: generation)
+          return unless policy
+
+          renewable, kerberos = policy
+          renewed = (renewable && renew_token(generation: generation)) || (kerberos && reauth_kerberos(generation: generation))
+          return unless @state_mutex.synchronize { active_generation?(generation: generation) }
+
+          if renewed
+            on_renewal_success(generation: generation)
           else
-            if reauth_kerberos # rubocop:disable Style/IfInsideElse
-              on_renewal_success
-            else
-              on_renewal_failure
-            end
+            on_renewal_failure(generation: generation)
           end
         end
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.renewal_loop', cluster_name: @cluster_name)
         log.warn("TokenRenewer[#{@cluster_name}]: renewal loop error: #{e.message}")
-        retry unless @stop
+        on_renewal_failure(generation: generation)
+        retry if @state_mutex.synchronize { active_generation?(generation: generation) }
+      end
+
+      def renewal_policy(generation:, **)
+        @state_mutex.synchronize do
+          return unless active_generation?(generation: generation)
+
+          kerberos = @config[:auth_method].to_s == 'kerberos'
+          if @expires_at && @expires_at <= Time.now
+            @config[:connected] = false
+            @config[:relogin_required] = true unless kerberos
+            return unless kerberos
+          end
+          return if !kerberos && (!@config[:renewable] || @config[:relogin_required])
+
+          [@config[:renewable], kerberos]
+        end
       end
 
-      def on_renewal_success
-        reset_backoff
-        interruptible_sleep(sleep_duration)
+      def on_renewal_success(generation:)
+        return unless reset_backoff(generation: generation)
+
+        interruptible_sleep(sleep_duration, generation: generation)
       end
 
-      def on_renewal_failure
-        @config[:connected] = false
-        delay = next_backoff
+      def on_renewal_failure(generation:)
+        delay = next_backoff(generation: generation)
+        return unless delay
+
+        @state_mutex.synchronize do
+          return unless active_generation?(generation: generation)
+
+          kerberos = @config[:auth_method].to_s == 'kerberos'
+          remaining = @expires_at && (@expires_at - Time.now)
+          if kerberos || @renewal_terminal || (remaining && !remaining.positive?)
+            @config[:connected] = false
+            @config[:relogin_required] = true unless kerberos
+          end
+          return if !kerberos && @config[:relogin_required]
+
+          delay = [delay, [remaining / 2, MINIMUM_WAIT].max, remaining].min if remaining&.positive?
+        end
         log.warn("TokenRenewer[#{@cluster_name}]: backoff retry in #{delay}s")
-        interruptible_sleep(delay)
+        interruptible_sleep(delay, generation: generation)
       end
 
-      def reissue_all_leases
+      def reissue_all_leases(active:)
         return unless defined?(Legion::Crypt::LeaseManager)
+        return unless active.call
 
-        Legion::Crypt::LeaseManager.instance.reissue_all
+        Legion::Crypt::LeaseManager.instance.reissue_all(active: active)
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.reissue_all_leases', cluster_name: @cluster_name)
         log.warn("TokenRenewer[#{@cluster_name}]: failed to reissue leases after reauth: #{e.message}")
       end
 
-      def interruptible_sleep(seconds)
+      def interruptible_sleep(seconds, generation:)
         deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + seconds
-        loop do
-          remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
-          break if remaining <= 0 || @stop
+        @state_mutex.synchronize do
+          while active_generation?(generation: generation)
+            remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+            break unless remaining.positive?
 
-          sleep([remaining, 1.0].min)
+            @wake.wait(@state_mutex, remaining)
+          end
         end
       end
 
-      def stop_thread_and_revoke
-        return unless @thread
+      def stop_thread_and_revoke(thread:, deadline:)
+        return unless thread
 
         log.info("TokenRenewer[#{@cluster_name}]: stopping token renewal thread")
-        @thread.join(5)
-        thread_still_running = @thread.alive?
+        remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+        thread.join(remaining) if remaining.positive? && thread != Thread.current
 
-        if thread_still_running
+        if thread.alive?
           log.warn("TokenRenewer[#{@cluster_name}]: token renewal thread did not stop within timeout; skipping token revocation")
         else
-          @thread = nil
-          revoke_token
+          @state_mutex.synchronize { @thread = nil if @thread == thread }
+          revoke_token(deadline: deadline)
           log.info("TokenRenewer[#{@cluster_name}]: token renewal thread stopped")
         end
       end
 
-      def revoke_token
-        return unless @vault_client&.token
-        return unless @config[:auth_method]&.to_s == 'kerberos'
+      def revoke_token(deadline: nil)
+        owned_token = @state_mutex.synchronize do
+          @config[:auth_method]&.to_s == 'kerberos' && @vault_client&.token
+        end
+        return unless owned_token
 
-        @vault_client.auth_token.revoke_self
+        VaultOperation.with_timeout(deadline: deadline) { @vault_client.auth_token.revoke_self }
         log.info("TokenRenewer[#{@cluster_name}]: Vault token revoked")
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.revoke_token', cluster_name: @cluster_name)