Is your feature request related to a problem? Please describe.
requeueDurationOnError is hardcoded to 5s and not configurable. When a VaultStaticSecret gets a 403 from Vault, c.Taint() is called, and every subsequent reconcile fails at ClientFactory.Get(), which uses this hardcoded 5s. With many failing VaultStaticSecret resources, this produces a constant request flood to Vault at N secrets × 1 req/5s with no way to tune it.
Setting backoffOnSecretSourceError.initialInterval in values.yaml has no effect here. It only configures BackOffRegistry, which is never reached once the client is tainted.
Describe the solution you'd like
Expose requeueDurationOnError as a configurable value in values.yaml, similar to how backoffOnSecretSourceError is already structured. Alternatively, make the ClientFactory.Get() failure path use BackOffRegistry so that backoffOnSecretSourceError applies consistently across all error paths.
Describe alternatives you've considered
- Reducing maxConcurrentReconciles (default: 100) to throttle overall request volume — mitigates the flood but does not fix the interval
- Fixing the underlying auth issue — resolves the symptom but operators should still be able to control retry behavior independently
Additional context
Verified across v0.9.0 → v1.3.0 (latest)
Is your feature request related to a problem? Please describe.
requeueDurationOnErroris hardcoded to 5s and not configurable. When aVaultStaticSecretgets a 403 fromVault,c.Taint()is called, and every subsequent reconcile fails atClientFactory.Get(), which uses this hardcoded 5s. With many failingVaultStaticSecretresources, this produces a constant request flood to Vault at N secrets × 1 req/5s with no way to tune it.Setting
backoffOnSecretSourceError.initialIntervalin values.yaml has no effect here. It only configuresBackOffRegistry,which is never reached once the client is tainted.Describe the solution you'd like
Expose
requeueDurationOnErroras a configurable value invalues.yaml, similar to howbackoffOnSecretSourceErroris already structured. Alternatively, make theClientFactory.Get()failure path useBackOffRegistryso thatbackoffOnSecretSourceErrorapplies consistently across all error paths.Describe alternatives you've considered
Additional context
Verified across v0.9.0 → v1.3.0 (latest)