From 573e2d77dab3ffedecd2ed2a1e1536a3112db9dd Mon Sep 17 00:00:00 2001 From: hghaf099 <83242695+hghaf099@users.noreply.github.com> Date: Mon, 23 Aug 2021 17:22:28 -0400 Subject: [PATCH] Lease count quotas does not apply to root tokens (#12405) --- website/content/docs/enterprise/lease-count-quotas.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/website/content/docs/enterprise/lease-count-quotas.mdx b/website/content/docs/enterprise/lease-count-quotas.mdx index cee6c3d69a..2a570a4971 100644 --- a/website/content/docs/enterprise/lease-count-quotas.mdx +++ b/website/content/docs/enterprise/lease-count-quotas.mdx @@ -13,6 +13,10 @@ number of leases in the cluster hits the configured limit, `max_leases`, additio lease creations will be forbidden for all clients until a lease has been revoked or has expired. +It is important to note that lease count quotas do not apply to the root tokens. +If the number of leases in the cluster hits the configured limit, `max_leases`, +an operator could still create a root token and access the cluster to try to recover. + All the nodes in the Vault cluster will share the lease quota rules, meaning that the lease counters will be shared, regardless of which node in the Vault cluster receives lease generation requests. Lease quotas can be imposed across Vault's API,