Child lease cleanup after parent token revocation

Child lease cleanup after parent token revocation

Goal: determine whether revoking a parent token invalidates all child leases immediately, or whether applications must tolerate orphaned leases until each lease TTL expires.

Constraint: Vault documents token revocation cascade as best-effort. If a child lease’s secrets engine is unavailable, revocation can fail and the lease may remain valid. Vault exposes no metric for pending or failed child lease revocations; the expiration manager removes leases only at TTL expiry.

Assumes Vault 1.17 or later with integrated storage. Replication lag is out of scope; the question concerns local cascade semantics.

Does Vault retry failed child lease revocations after the parent token revocation completes? Is there a supported way to force cleanup of orphaned child leases before TTL expiry? Should client code treat parent token revocation as proof that child leases are invalid?