[BUG] Default Configuration leaks certificates in vault.db

[verdantvestibule]

Describe the Bug

Default configuration results in certificates being created by the plugin and stored in the vault.db that are never reaped:

	no_store = T	no_store = F (default)
generate_lease = T	do not store cert	reap cert on expiry
generate_lease = F (default)	do not store cert	keep all certs FOREVER

To Reproduce

Steps to reproduce the behavior:

1. Install the Plugin
2. Configure a secret mount, but don't change no_store or generate_lease values
3. Create certs
4. ... now how do you clear them up?

Expected Behavior

These two interrelated parameters should be encapsulated in a single “enum” setting. Short of that it should absolutely not be possible for both to be true, or both to be false and a safe default should be provided (probably generate_lease=true).

Product Deployment

Please complete the following information:

• Deployment format: Plugin
• Version: 1.5.0

Desktop

Please complete the following information:

• OS: Linux (Ubuntu(
• Browser: N/A
• Version: ?

Additional Context

Turns out >1M certs really ups the CPU, Memory, and Latency of Vault!

[joevanwanzeeleKF]

Thank you for taking the time to submit this issue. We have created a work item to address the inability to purge expired certs. Rather than using leases, we will match the strategy of the Vault PKI Secrets Engine and provide an endpoint for immediate "tidying" of certs that exceed their TTL, as well as an endpoint to configure regular, automatic tidying at a specified interval. This feature is scheduled to be included in the next release.

[verdantvestibule]

I would like to clarify here that it is not necessarily about purging expired certs... though that is valuable. The problem is that the default configuration accrues certs that are kept forever.

1. The default must ensure that certs don't just fall down a hole, and are automatically managed
2. a tidy endpoint is valuable, but then should allow tidying of specific certs, all certs, expired certs, etc.
3. even with a manual tidy endpoint, there is value in using leases to ensure that as certs expire they are automatically cleaned up without user intervention.