Comment 3 for bug 1844092

Another possibility that comes to mind would be that the unit token was regenerated on the Vault side for some reason but then also didn't make it over the relation in time before k8s-master saw and tried to use the old, now invalid value.

You could check for this by seeing if there were multiple instances of "Invoking reactive handler: .*configure_secrets_backend" in the Vault charm log.