Add the ability to revoke leases on SIGTERM/SIGKILL

[rocktavious]

I started this thread - https://groups.google.com/forum/?nomobile=true#!topic/vault-tool/P-4Wf72vDs8

And was directed to make an issue here for further discussion/help.

I've looked over the documentation and i see information here about envconsul and signals - https://github.com/hashicorp/envconsul#signals.

But it would awesome if upon shutdown of the downstream subprocess if envconsul also issued vault revoke lease on all the dynamic credentials and the token it was using before exiting?

The usecase is we have envconsul (in a startup shell script) running as PID 1 inside a docker container being launched on kubernetes, it uses the kubernetes service token to trade for a vault token and then uses envconsul to run the downstream process with the secrets from vault. Most of our engineers are using dynamic secrets from the Database and AWS secret engines, and that means that when kubernetes moves or shuts down the pod the leases are left open polluting vault for the rest of their TTL. (not a terrible thing, but an annoyance)

Since envconsul knows about signals, it would be great if you could configure it to also revoke the leases for things when its cleaning up/shutting down.

Consider this a feature request - but also if we could get some guidance on exactly where to go about implementing this (if possible) we could have engineers on our team look into creating a PR for envconsul for this feature.

Thanks,
Kyle Rockman
Under Armour Connected Fitness

[morganwalker]

@rocktavious I was wondering if you could have a look at #177. We're trying to implement your use case but it seems envconsul isn't correctly killing the child process prior to spawning the new one. Any help would be appreciated but completely understand how your time could be spent better elsewhere.

Thanks,
Morgan

[jhmartin]

Perhaps this could be generalized, rather than worrying about subprocess restarts -- how about when envconsul is terminating, it first revokes any leases it has acquired, and optionally revokes the vault auth as well (ie revoke-self)?