cache is forever (e.g. ignores `lease_duration`)

[seamusabshere]

let's say your creds roll in vault

the current cache never expires, so you have to restart your process to get new creds

[erithmetic]

def. on the roadmap (my mental roadmap)

[emk]

Basic caching policy:

1. If secrets are older than half their TTL (a standard rule of thumb), attempt to fetch new copies.
2. If you can't fetch new secrets, just keep using the old ones, whether or not the TTL has expired. At worst, they might have stopped working.

There are some extra wrinkles for correctly handling dynamic credentials that map to multiple env-var-style keys, to avoid getting a username from one dynamic cred, and the password from another one.