Vault "lease is not renewable" in CI

By Kaveh Alemi·Latchkey

A renew call failed because the lease is flagged non-renewable. Some tokens and dynamic secret leases are issued renewable=false, so extending them is not allowed; you must acquire a fresh one.

What this error means

A vault token renew or vault lease renew fails with "Code: 400 ... * lease is not renewable" or "invalid lease".

Error renewing token: Error making API request.

URL: PUT https://vault.example.com/v1/auth/token/renew-self
Code: 400. Errors:

* lease is not renewable

Common causes

The token or lease was issued non-renewable

The role or mount sets renewable=false (or the lease already hit its max TTL), so Vault refuses to extend it.

The CI logic renews instead of re-authenticating

The pipeline tries to renew a one-shot token when it should simply log in again for a new token.

How to fix it

Re-authenticate instead of renewing

1. Drop the renew step for short CI tokens.
2. Log in again to get a fresh token when the current one nears expiry.
3. Or make the role issue renewable tokens if renewal is genuinely needed.

# get a new token rather than renewing an unrenewable one
vault write -field=token auth/approle/login \
  role_id="$ROLE_ID" secret_id="$SECRET_ID"

Make the role issue renewable tokens

If you must renew, configure the role to allow it.

vault write auth/approle/role/ci \
  token_ttl=30m token_max_ttl=2h

How to prevent it

• For short CI jobs, use single-use tokens and skip renewal.
• Only renew leases that are explicitly renewable with headroom under max TTL.
• Re-login for a fresh token rather than fighting a non-renewable lease.

Frequently asked questions

Related guides

References

• GitHub Actions documentation