Skip to content

Commit

Permalink
VAULT-12564 Docs for token file auth method (#18783)
Browse files Browse the repository at this point in the history
* VAULT-12564 Docs for token file auth method

* VAULT-12564 fix typo

* VAULT-12564 nav data

* VAULT-12564 Add note, remove token file removal config

* VAULT-12564 stronger wording

* VAULT-12564 auth -> auto-auth
  • Loading branch information
VioletHynes authored Jan 25, 2023
1 parent 37b1ab1 commit 46c7f7e
Show file tree
Hide file tree
Showing 3 changed files with 71 additions and 1 deletion.
2 changes: 1 addition & 1 deletion website/content/docs/agent/autoauth/methods/approle.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ auto_auth {
}
cache {
api_proxy {
use_auto_auth_token = true
}
Expand Down
66 changes: 66 additions & 0 deletions website/content/docs/agent/autoauth/methods/token_file.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
---
layout: docs
page_title: Vault Agent Auto-Auth Token File Method
description: Token File Method for Vault Agent Auto-Auth
---

# Vault Agent Auto-Auth Token File Method

~> Note: This authentication method is tailored for the development experience,
and to facilitate getting started with Vault Agent. Vault Agent should never be configured to use
this auto-auth method in a production environment.

The `token_file` method reads in an existing, valid Vault token from a file, and uses that
token in lieu of authenticating itself. While it's a first class auto-auth method for all intents
and purposes, it naturally doesn't authenticate itself, as it requires a token from elsewhere. Like
other auto-auth methods, Agent will attempt to renew the token, as appropriate.

This auto-auth method is especially useful when testing Vault Agent without needing to set up
any authentication methods in Vault. For long-running Agent processes, we strongly recommend another
auto-auth method, such that Agent is issuing its own authentication requests to Vault.

## Configuration

- `token_file_path` `(string: required)` - The path to the file with the token inside. This token cannot be a wrapping token.

## Example Configuration

An example configuration, using the `token_file` method to enable [auto-auth](/docs/agent/autoauth), follows:

```hcl
pid_file = "./pidfile"
vault {
address = "https://127.0.0.1:8200"
}
auto_auth {
method {
type = "token_file"
config = {
token_file_path = "~/.vault-token"
}
}
}
api_proxy {
use_auto_auth_token = true
}
listener "tcp" {
address = "127.0.0.1:8100"
tls_disable = true
}
template {
source = "/etc/vault/server.key.ctmpl"
destination = "/etc/vault/server.key"
}
template {
source = "/etc/vault/server.crt.ctmpl"
destination = "/etc/vault/server.crt"
}
```
4 changes: 4 additions & 0 deletions website/data/docs-nav-data.json
Original file line number Diff line number Diff line change
Expand Up @@ -901,6 +901,10 @@
{
"title": "Kubernetes",
"path": "agent/autoauth/methods/kubernetes"
},
{
"title": "Token File",
"path": "agent/autoauth/methods/token_file"
}
]
},
Expand Down

0 comments on commit 46c7f7e

Please sign in to comment.