feat: make lease renewal threshold configurable

[mmcgarr]

Description

Makes lease renewal threshold configurable in the vault agent config. Currently this is hardcorded to renew after 2/3 of the lease duration has passed. We would like this to be configurable so we can control when leased credentials are renewed.

To maintain backward compatibility, the default renewal threshold is configured as 0.667 (2/3) and this can be overridden as required with a value in the range 0-1.

vault {
  address = "http://127.0.0.1:8200"
}

auto_auth {
  method {
    type      = "approle"
    lease_renewal_threshold = 0.75
    config = {
      role_id_file_path = "/tmp/role-id"
      secret_id_file_path = "/tmp/secret-id"
    }
  }

  sink {
    type = "file"
    config = {
      path = "/tmp/token"
    }
  }
}

Fixes #31505

Notes

I need to finish testing this but would love to know if this looks like a change that could be accepted 🙏

[vercel]

@mmcgarr is attempting to deploy a commit to the HashiCorp Team on Vercel.

A member of the Team first needs to authorize it.