Vault secret operator throw error `Lease renewal duration was truncated`

Vault
1

Hi folks,

I’m using Vault Secret Operator v0.4.0 for setting up connection between k8s application and Vault server version 14.1.0
So for the GCP service_account_key, I use roleset like below

vault write gcp/roleset/application_name \
  project="${PROJECT_ID}" \
  bindings=@./policy-gcp-bindings.hcl \
  secret_type="service_account_key"

vault policy write application_policy policy.hcl

vault write auth/sandbox-kubernetes/role/application_role\
  bound_service_account_names="application_service_account \
  bound_service_account_namespaces="default" \
  policies="application_policy" \
  ttl="24h" \
  max_ttl="24h"

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  namespace: default
  name: application_name
spec:
  vaultAuthRef: auth-ref-name
  path: key/****/*****
  destination:
    create: true
    name: secret_name
  renewalPercent: 67
  rolloutRestartTargets:
    - kind: Deployment
      name: application_name

And I’m facing with the issue vault secret operator manager throw the error like below many time. And some time within the day the cronjob.

Log event

2023-11-29T02:18:12Z	DEBUG	events	Lease renewal duration was truncated from 86400s to 23192s, requesting new credentials	{"type": "Normal", "object": {"kind":"VaultDynamicSecret","namespace":"default","name":"application_name","uid":"6789d53a-9c00-4ce8-8936-360cb85d6c27","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"1335067039"}, "reason": "SecretLeaseRenewal"}

2023-11-29T02:18:13Z	DEBUG	events	Secret synced, lease_id="gcp/key/****/*****", horizon=17h13m31.223998373s	{"type": "Normal", "object": {"kind":"VaultDynamicSecret","namespace":"default","name":"application_name","uid":"6789d53a-9c00-4ce8-8936-360cb85d6c27","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"1335911803"}, "reason": "SecretRotated"}

2023-11-29T02:18:13Z	DEBUG	events	Rollout restart triggered for {Deployment application_name}	{"type": "Normal", "object": {"kind":"VaultDynamicSecret","namespace":"default","name":"application_name","uid":"6789d53a-9c00-4ce8-8936-360cb85d6c27","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"1335911803"}, "reason": "RolloutRestartTriggered"}

So Is there any wrong with the set up? And are you facing with that issue? Because sometime within the day the key invalid and throw an invalid jwt error for the job.