max-lease-ttl not being honored for PKI engine

[Cory Johns]

The max-lease-ttl set by the charm (https://github.com/openstack/charm-vault/blob/master/src/lib/charm/vault_pki.py#L33) does not seem to be being honored. After deploying the charm and using the actions to set the certs and enable PKI, using `vault secrets list -detailed` still shows a Max TTL for the engine of "system" and certs get their expiration values set to 30 days (the default). Using `vault secrets tune` manually does update the Max TTL value.

[Cory Johns (johnsca)]

This has been hit by a user, reported here: https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/719

[Cory Johns (johnsca)]

The line linked in the OP has moved. The new correct line is: https://github.com/openstack/charm-vault/blob/379b99f/src/lib/charm/vault_pki.py#L29

[James Page (james-page)]

The key used to set the TTL during PKI mount is not setting the TTL correctly.

[James Page (james-page)]

The fix will also need to tune any existing PKI backend to set the TTL correctly, at which point a cert re-issue will then dtrt and re-issue certs with longer expiry dates

[James Page (james-page)]

https://review.openstack.org/#/c/631202/