legion-crypt 1.5.8 → 1.5.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b2c9243c14fe8bce1a6abb0de6a29681b08b8c8719ff592f2191581209131a38
-  data.tar.gz: 3880aee6fb5c3c82606317dd82c80f64f3f3a84c984c72fcd23402a263f262a6
+  metadata.gz: 42200f56d577b407725621c56af4f7d191c1ad0219c33c99f5e4adc02568aac6
+  data.tar.gz: c231674d541726ab2fa3cf381e655a67be065e2481ce4f50c39d42b52875f6fa
 SHA512:
-  metadata.gz: 1001efcac237f95827a8784886050e5047afca4830eec8cc962cf72e119c875694477c3dddad011c56dd643bdf42aab8eab8e4a027afda303ddf306c03eea7de
-  data.tar.gz: fcb5bf8a7527a65221bd917ee1574ce633609f60d00dd070135e4316f05b6c5f0b95ddf251544230e3cf7d0740aa9fa2ea1f4975c638b8e440e50fa282ff5d6c
+  metadata.gz: 2ee34bea6a9a73af47707259d8b857dfc1c1eb8f9e3519ccbefd811bb43e182c734795d15732de82058acb1101f3ba14bc16c39feeae87873c290e2aad58c049
+  data.tar.gz: b4d4c72a242b0cfb229dcb27f654f41e6dfd6c3035c73901345588639ea102969e83edb31e5b9572705f674eeba8bd3a6fe89915b9db4ca2eedd33749c12fcf3

data/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [1.5.9] - 2026-04-10
+
+### Fixed
+- Vault lease cascade revocation: all three service credentials (RabbitMQ, PostgreSQL, Redis) died at exactly 2 hours when the Vault Kerberos auth token expired — Vault cascade-revokes all child leases when the parent token dies, regardless of individual lease TTLs (closes #29)
+- `TokenRenewer` now detects non-renewable tokens (`renewable=false`) and skips `renew_self` (which always fails for non-renewable tokens), going straight to `reauth_kerberos` before the token expires
+- `TokenRenewer#reauth_kerberos` now triggers `LeaseManager.reissue_all` after obtaining a new token, re-issuing all active leases under the new token so they are not orphaned when the old token expires
+- `LeaseManager#push_to_settings` symbol/string key mismatch: `resolve_secrets!` registers refs with string keys (`"rabbitmq"`) via `lease://` URI parsing, but `cache_lease` stores leases with symbol keys (`:rabbitmq` from `Legion::JSON.load`) — now tries both key types
+- `LeaseManager#trigger_reconnect` for `:postgresql` — uses surgical Sequel pool `disconnect` + `test_connection` instead of `Data.shutdown + Data.setup` which tore down unrelated connections (Apollo SQLite, Local cache)
+- `LeaseManager#trigger_reconnect` for `:redis` — uses `Cache.restart` (the actual method) instead of `Cache.reconnect` (which does not exist)
+
+### Added
+- `LeaseManager#reissue_all` — re-issues all active leases under the current vault client token; called by `TokenRenewer` after successful Kerberos re-authentication to prevent cascade revocation of orphaned leases
+
 ## [1.5.8] - 2026-04-09
 
 ### Added

data/lib/legion/crypt/lease_manager.rb

@@ -86,7 +86,9 @@ module Legion
 
       def push_to_settings(name)
         refs, data = @state_mutex.synchronize do
-          [@refs[name]&.dup, @lease_cache[name]&.dup]
+          r = @refs[name] || @refs[name.to_s] || @refs[name.to_sym]
+          d = @lease_cache[name] || @lease_cache[name.to_s] || @lease_cache[name.to_sym]
+          [r&.dup, d&.dup]
         end
         return if refs.nil? || refs.empty?
         return unless data
@@ -109,6 +111,19 @@ module Legion
         sys
       end
 
+      def reissue_all
+        log.info('LeaseManager: reissue_all — re-issuing all active leases under new token')
+        lease_names = @state_mutex.synchronize { @active_leases.keys.dup }
+
+        lease_names.each do |name|
+          lease = @state_mutex.synchronize { @active_leases[name]&.dup }
+          next unless lease && lease[:path]
+
+          reissue_lease(name)
+        end
+        log.info('LeaseManager: reissue_all complete')
+      end
+
       def register_dynamic_lease(name:, path:, response:, settings_refs:)
         register_at_exit_hook
 
@@ -451,14 +466,19 @@ module Legion
           Legion::Transport::Connection.force_reconnect
           log.info("LeaseManager: triggered transport reconnect after '#{name}' reissue")
         when :postgresql
-          return unless defined?(Legion::Data) && Legion::Data.respond_to?(:reconnect)
+          return unless defined?(Legion::Data::Connection) && Legion::Data::Connection.sequel
 
-          Legion::Data.reconnect
-          log.info("LeaseManager: triggered data reconnect after '#{name}' reissue")
+          Legion::Data::Connection.sequel.disconnect
+          Legion::Data::Connection.sequel.test_connection
+          log.info("LeaseManager: triggered data pool reconnect after '#{name}' reissue")
         when :redis
-          return unless defined?(Legion::Cache) && Legion::Cache.respond_to?(:reconnect)
+          return unless defined?(Legion::Cache)
 
-          Legion::Cache.reconnect
+          if Legion::Cache.respond_to?(:restart)
+            Legion::Cache.restart
+          elsif Legion::Cache.respond_to?(:reconnect)
+            Legion::Cache.reconnect
+          end
           log.info("LeaseManager: triggered cache reconnect after '#{name}' reissue")
         end
       rescue StandardError => e

data/lib/legion/crypt/token_renewer.rb

@@ -72,7 +72,9 @@ module Legion
         @config[:renewable]      = result[:renewable]
         @config[:connected]      = true
         @vault_client.token      = result[:token]
-        log.info("TokenRenewer[#{@cluster_name}]: re-authenticated via Kerberos")
+        log.info("TokenRenewer[#{@cluster_name}]: re-authenticated via Kerberos, ttl=#{result[:lease_duration]}s")
+
+        reissue_all_leases
         true
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.reauth_kerberos', cluster_name: @cluster_name)
@@ -104,10 +106,18 @@ module Legion
         interruptible_sleep(sleep_duration)
 
         until @stop
-          if renew_token || reauth_kerberos
-            on_renewal_success
+          if @config[:renewable]
+            if renew_token || reauth_kerberos
+              on_renewal_success
+            else
+              on_renewal_failure
+            end
           else
-            on_renewal_failure
+            if reauth_kerberos # rubocop:disable Style/IfInsideElse
+              on_renewal_success
+            else
+              on_renewal_failure
+            end
           end
         end
       rescue StandardError => e
@@ -128,6 +138,15 @@ module Legion
         interruptible_sleep(delay)
       end
 
+      def reissue_all_leases
+        return unless defined?(Legion::Crypt::LeaseManager)
+
+        Legion::Crypt::LeaseManager.instance.reissue_all
+      rescue StandardError => e
+        handle_exception(e, level: :warn, operation: 'crypt.token_renewer.reissue_all_leases', cluster_name: @cluster_name)
+        log.warn("TokenRenewer[#{@cluster_name}]: failed to reissue leases after reauth: #{e.message}")
+      end
+
       def interruptible_sleep(seconds)
         deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + seconds
         loop do
@@ -150,7 +169,7 @@ module Legion
         else
           @thread = nil
           revoke_token
-          log.debug("TokenRenewer[#{@cluster_name}]: token renewal thread stopped")
+          log.info("TokenRenewer[#{@cluster_name}]: token renewal thread stopped")
         end
       end
 

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.8'
+    VERSION = '1.5.9'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.8
+  version: 1.5.9
 platform: ruby
 authors:
 - Esity