Backport of db: honor static role TTL across restarts when skip import rotation i… into release/1.18.x

[hc-github-team-secure-vault-core]

Backport

This PR is auto-generated from #29537 to be assessed for backporting due to the inclusion of the label backport/1.18.x.

The below text is copied from the body of the original PR.

---

Description

The associated Enterprise PR is here: https://github.com/hashicorp/vault-enterprise/pull/7426

Fix a bug where passwords are rotated across backend restarts when they should not be.

Solution

Use a the field NextVaultRotation which is Now + RotationPeriod (or next schedule) to calculate the queue priority in across backend reloads and calculate the TTL on GET /static-cred requests.

Background

When skipping auto import rotation is enabled, vault does not rotate the password, leaving role.StaticAccount.LastVaultRotation as a zero value. This is problematic because Vault determines when to rotate a credential using LastVaultRotation + rotationPeriod. If LastVaultRotation is the zero value, adding rotationPeriod causes the credential to be placed at the front of the priority queue, triggering an immediate rotation on unseal.

We currently handle this in memory by setting LastVaultRotation to the current timestamp, ensuring that the credential doesn’t get pushed to the front of the queue. However, this is only done in memory (priority queue) and is not persisted to storage. If the secrets engine gets reinitialized, Vault reloads static roles from storage with LastVaultRotation as the zero value. Vault again adds rotationPeriod, pushing the credential to the front of the queue and immediately rotating it. This unexpected rotation can cause issues for customers who are not expecting their credentials to change.

TODO only if you're a HashiCorp employee

• Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch. Note that in the CE repo, the latest release branch will look like backport/x.x.x, but older release branches will be backport/ent/x.x.x+ent.
  • LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
• ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
  of a public function, even if that change is in a CE file, double check that
  applying the patch for this PR to the ENT repo and running tests doesn't
  break any tests. Sometimes ENT only tests rely on public functions in CE
  files.
• Jira: If this change has an associated Jira, it's referenced either
  in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.
• ENT PR: If this change has an associated ENT PR, please link it in the
  description. Also, make sure the changelog is in this PR, not in your ENT PR.

---

Overview of commits

• 8d0443f

[github-actions]

CI Results:
All Go tests succeeded! ✅

[github-actions]

Build Results:
All builds succeeded! ✅