Refreshing Vault OIDC JWTs with consul-template

Hi, i have a simple setup of Vault, running as an oidc-identity-provider. This involves creating an identity/oidc/role and issuing a command like the following to generate a JWT:

vault read identity/oidc/role/acme

I then have a consul template demo-template.yml like this:

# Rendered using Consul Template at {{ timestamp }}
# Get JWTs from vault!
{{ with secret "identity/oidc/token/acme"}}
{{ .Data.token }}
{{ end }}

and run as

consul-template -template “demo-template.yml.tmpl:output.txt:cat output.txt”

This works - to an extent. A JWT is created every 1.5 mins, but i dont know why. The role TTL i have set for the JWT is 30 days - and I can see that is reflected in the expiry claim of the JWT. Can anyone help me understand what is actually triggering the JWT to be created/refreshed?

Using hashicorp/consul:latest and hashicorp/vault:latest


This is the consul template debug logs (feel free to decode the JWT - its just from a through away vault instance/key!)

2024/03/26 16:32:15.514596 [DEBUG] (runner) receiving dependency
2024/03/26 16:32:15.514644 [DEBUG] (runner) initiating run
2024/03/26 16:32:15.514649 [DEBUG] (runner) checking template c363382866fd902acd2ab0b571012b6e
2024/03/26 16:32:15.515004 [DEBUG] (runner) rendering "demo-template.yml.tmpl" => "output.txt"
2024/03/26 16:32:15.522869 [INFO] (runner) rendered "demo-template.yml.tmpl" => "output.txt"
2024/03/26 16:32:15.522886 [DEBUG] (runner) appending command "cat output.txt" from "demo-template.yml.tmpl" => "output.txt"
2024/03/26 16:32:15.522892 [DEBUG] (runner) diffing and updating dependencies
2024/03/26 16:32:15.522900 [DEBUG] (runner) is still needed
2024/03/26 16:32:15.522904 [INFO] (runner) executing command "cat output.txt" from "demo-template.yml.tmpl" => "output.txt"
2024/03/26 16:32:15.522926 [INFO] (child) spawning: cat output.txt
# Rendered using Consul Template at 2024-03-26T16:32:15Z
# Get JWTs from vault!

2024/03/26 16:32:15.525073 [DEBUG] (runner) watching 2 dependencies
2024/03/26 16:32:15.525118 [DEBUG] (runner) all templates rendered
2024/03/26 16:32:15.525086 [DEBUG] (cli) receiving signal "child exited"

, and the next logging has the line:

# Rendered using Consul Template at 2024-03-26T16:33:44Z

i.e. ~1.5 mins later