Add support for optional jitter parameter on CN

vault_resource.go

@@ -48,6 +48,10 @@ const (
 	optionMode = "mode"
 	// optionMaxRetries is the maximum number of retries that should be attempted
 	optionMaxRetries = "retries"
+	// optionMaxJitter is the maximum amount of jitter that should be applied
+	// to updates for this resource. If non-zero, a random value between 0 and
+	// maxJitter will be subtracted from the update period.
+	optionMaxJitter = "jitter"
 	// defaultSize sets the default size of a generic secret
 	defaultSize = 20
 )
@@ -117,6 +121,9 @@ type VaultResource struct {
 	// retries is the number of times this resource has been retried since it
 	// last succeeded
 	retries int
+	// maxJitter is the maximum jitter duration to use for this resource when
+	// performing renewals
+	maxJitter time.Duration
 }
 
 // GetFilename generates a resource filename by default the resource name and resource type, which

vault_resources.go

@@ -137,6 +137,12 @@ func (r *VaultResources) Set(value string) error {
 					return fmt.Errorf("the retries option: %s is invalid, should be an integer", value)
 				}
 				rn.maxRetries = int(maxRetries)
+			case optionMaxJitter:
+				maxJitter, err := time.ParseDuration(value)
+				if err != nil {
+					return fmt.Errorf("the jitter option: %s is invalid, should be in duration format", value)
+				}
+				rn.maxJitter = maxJitter
 			default:
 				rn.options[name] = value
 			}

watched_resource.go

@@ -57,6 +57,13 @@ func (r *watchedResource) notifyOnRenewal(ch chan *watchedResource) {
 			}
 			r.renewalTime = r.calculateRenewal()
 		}
+		if r.resource.maxJitter != 0 {
+			glog.V(4).Infof("using maxJitter (%s) to calculate renewal time", r.resource.maxJitter)
+			r.renewalTime = time.Duration(getDurationWithin(
+				int((r.renewalTime-r.resource.maxJitter)/time.Second),
+				int(r.renewalTime/time.Second),
+			))
+		}
 		glog.V(3).Infof("setting a renewal notification on resource: %s, time: %s", r.resource, r.renewalTime)
 		// step: wait for the duration
 		<-time.After(r.renewalTime)