Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-38203

Hashicorp plugin lets keys timeout and doesn't use cached keys on vault errors

    XMLWordPrintable

Details

    • Notable changes
    • Hide
      The HashiCorp Vault key management plugin has been updated to improve availability during intermittent network or server issues. Previously, the plugin only allowed the use of cached keys if a connection timed out. This behavior has been broadened and made the default to prevent MariaDB Server interruptions.

      * Expanded Error Handling: The plugin now treats common connectivity issues—such as “connection refused,” “no route to host,” and “internal server error”—the same as a timeout. This ensures the server continues to function using cached keys if the Vault server is briefly unreachable.
      * Updated Defaults:
      ** The option to use cached values during communication errors is now enabled by default.
      ** The cache timeout is now defaulting to the maximum value.
      Show
      The HashiCorp Vault key management plugin has been updated to improve availability during intermittent network or server issues. Previously, the plugin only allowed the use of cached keys if a connection timed out. This behavior has been broadened and made the default to prevent MariaDB Server interruptions. * Expanded Error Handling: The plugin now treats common connectivity issues—such as “connection refused,” “no route to host,” and “internal server error”—the same as a timeout. This ensures the server continues to function using cached keys if the Vault server is briefly unreachable. * Updated Defaults: ** The option to use cached values during communication errors is now enabled by default. ** The cache timeout is now defaulting to the maximum value.
    • Q1/2026 Server Maintenance

    Description

      The HashiCorp Vault key management plugin has a hashicorp-key-management-use-cache-on-timeout setting that makes it use cached key value and key version information beyond the actual cache entry lifetime in case that curl http calls to the Vault server can connect, but time out.

      A HTTP timeout is a rather unlikely error scenario here though, it is much more likely to get:

      • "connection refused" if the Vault server is down, even if just shortly but at the wrong moment
      • "no route to host" if the Vault host is not reachable, e.g. due to a VM restart
      • "internal server error" due to an error on the Vault server process itself

      None of these should bring down the MariaDB server by default when it is just trying to re-fetch a key it already has in the cache, or when trying to check for new key versions.

      So actually two requests here:

      • treat all http errors the same as http timeouts, either by adding a new option, or by extending the functionality of the already existing one
      • switch the default for "continue to use cached value in case of Vault communication problems" from OFF to ON

      Attachments

        Activity

          People

            serg Sergei Golubchik
            hholzgra Hartmut Holzgraefe
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.