Role Period not used on Auth tokens about vault-plugin-auth-kubernetes

[Capitrium]

Discussion continued here.

[dacohen]

We're having this same problem in Vault v0.10.1. Even if the role has a period set, the issued token does not. The linked discussion above doesn't have a solution, and while it looks like there were some code changes since this discussion, it looks like this is still an issue.

What's the best way to work around this bug? Is there a fix available?

[jefferai]

It's not a bug. Periods are only set directly on the token if the token was created via auth/token/create. Otherwise the period is controlled by the token issuer and its associated renew function.

[dacohen]

In that case, what's the best way to generate periodic tokens using the Kubernetes auth backend?

The documentation (https://www.vaultproject.io/api/auth/kubernetes/index.html#create-role) seems to indicate that creating a role with a period should cause tokens issued using that role to have that period, but if I'm understanding your comment correctly, this doesn't seem to be the case.

[jefferai]

When you create a token, does the TTL match the period value? When you renew it, does the TTL reset to the period value?