Secrets Manager: Backfill short TTL onto existing user_jwt CEL auth roles

Context

This is a follow-up to #604545 (closed), which added a ~5 minute token TTL to the user_auth_cel_program (the user_jwt CEL role) for newly provisioned roles.

That issue covers the forward path only. This issue covers the backfill: existing user_jwt CEL roles already provisioned in OpenBao do not yet have the short TTL and will continue to mint tokens with OpenBao's default lifetime (~32 days) if revoke-self fails.

Goal

Backfill the ~5 minute LeaseOptions TTL (set via pb.Auth in the CEL program) onto all existing user_jwt CEL roles already provisioned in OpenBao.

Notes

  • The backfill does not block !240596 (merged) or any other in-flight MR; it can follow independently.
  • The short TTL is the real fix and caps the blast radius. The backfill closes the window for tokens minted before the forward fix landed.
  • See #604545 (closed) for full context on the mechanism (JWT exp vs. OpenBao token TTL, CEL LeaseOptions syntax, integration test requirements).

Open question (carried from #604545 (closed))

Do we need a cron reaper that re-revokes tokens whose revoke-self failed, at least until the backfill completes? Initial take: probably unnecessary once the TTL is in place and backfilled, but worth confirming before committing to building one.

Related