Feature request: rotation_schedule / rotation_window for database static roles
Is your feature request related to a problem? Please describe.
Without rotation_schedule you can’t control when a database static role password gets rotated. That makes it hard to coordinate client app restarts so they pick up the new credentials cleanly.
Describe the solution you'd like
Please consider porting the Vault behaviour: support rotation_schedule (cron) and optional rotation_window on database static roles, mutually exclusive with rotation_period. These were added to Vault shortly after the Openbao fork.
Describe alternatives you've considered
Running an external cron that calls rotate-role and restarting the OpenBao Agent more frequently so it notices the new TTL/password. Haven't tried it yet. Perhaps there is a better workaround?
Explain any additional use-cases
I'm mostly running things in docker like Foregejo, Netbox and others that just take their database passwords at startup and have to be restarted in order to get a new one.
Additional context
I think that about does it. Thanks for openbao. You work is appreciated by many.
Source: openbao/openbao