Hacker News Reader

We do something very similar, tho we don't use JWT, just a token, and store the userID in the KV store.

How do you handle cleaning up the vault KV store? We have a separate process that runs around cleaning up old tokens, but am open to a better way.

View on HN

Vault does the expiration/cleaning up for you.

You are mistaken: "Even will a ttl set, the secrets engine never removes data on its own. The ttl key is merely advisory." - https://www.vaultproject.io/docs/secrets/kv/index.html

Which storage backend are you using for Vault? With MySql you could use scheduled events (no need to run/manage your own process), a created_at column in the Vault table and a scheduled check for created_at+ttl and have the DB to remove the tokens once the lease is expired. Also, if you were to use an etcd backend you could configure it to have it removed once the lease is expired. The only drawback is that the tokens TTL's are global and you can't set per user.

Consul. But good to know about these backends!

Yeah, for us etcd is OK as we are running on Kubernetes.

Reply on news.ycombinator.com