Knowledge base
Re-read keys from the store
Clears the internal Vault secrets cache — all entries at once. The next access to a secret will go to the store again.
Needed only where secrets come from Vault via the <vault> block: otherwise, after a secret changes in the store, the node keeps using the cached one.
The main trap is clearing the cache before the store is updated. The node immediately requests the secret again and caches the old one.
What the Hub does. It does not call it: the Hub does not keep node secrets in Vault, and there is no <vault> block in its configuration.
Recommended values
When to use it:
| Question | This command or not |
|---|---|
| the secret was changed in Vault, but the node holds the old one | yes |
| the node does not read the secret at all | no — check the <vault> block and access to the store |
The purpose comes from the manual (§ 6.3.2). The analysis of the change order is ours.
Example configuration
# after changing a secret in the store pmta clear secretscache
The command has no options: the whole cache is cleared.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄
Related entries
2 relations
Same name in other blocks
Flush the name cacheA neighboring command: the same subject from another side. § 6.3.2
How to check on the node
Check whether the node takes secrets from the store:
grep -n -A5 '<vault' /etc/pmta/config
No <vault> block — the command is not needed on this node.
◇
What else to read
2 articles
◇How the node signs messages and chooses a keyThe key is chosen by the sending domain from the headers, going through the declarations from top to bottom.◇Secrets in an external vaultSigning keys can be kept in HashiCorp Vault: the configuration keeps a path, and the engine fetches the key over HTTP and keeps it in memory without writing it to disk.
In the Hub
- Cost of a mistake
- reversible: harms only while it is set
- Scenarios
- Key rotation