Skip to content

VaultStaticSecret: ClientFactory auth failure retry interval should be configurable #1247

@madhu-guptask

Description

@madhu-guptask

Is your feature request related to a problem? Please describe.
requeueDurationOnError is hardcoded to 5s and not configurable. When a VaultStaticSecret gets a 403 from Vault, c.Taint() is called, and every subsequent reconcile fails at ClientFactory.Get(), which uses this hardcoded 5s. With many failing VaultStaticSecret resources, this produces a constant request flood to Vault at N secrets × 1 req/5s with no way to tune it.

Setting backoffOnSecretSourceError.initialInterval in values.yaml has no effect here. It only configures BackOffRegistry, which is never reached once the client is tainted.

Describe the solution you'd like
Expose requeueDurationOnError as a configurable value in values.yaml, similar to how backoffOnSecretSourceError is already structured. Alternatively, make the ClientFactory.Get() failure path use BackOffRegistry so that backoffOnSecretSourceError applies consistently across all error paths.

Describe alternatives you've considered

  • Reducing maxConcurrentReconciles (default: 100) to throttle overall request volume — mitigates the flood but does not fix the interval
  • Fixing the underlying auth issue — resolves the symptom but operators should still be able to control retry behavior independently

Additional context
Verified across v0.9.0 → v1.3.0 (latest)

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions