Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VAULT-12564 Docs for token file auth method #18783

Merged
merged 6 commits into from
Jan 25, 2023
Merged
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion website/content/docs/agent/autoauth/methods/approle.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ auto_auth {
}
cache {
api_proxy {
use_auto_auth_token = true
}
Expand Down
65 changes: 65 additions & 0 deletions website/content/docs/agent/autoauth/methods/token_file.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
---
layout: docs
page_title: Vault Agent Auto-Auth Token File Method
description: Token File Method for Vault Agent Auto-Auth
---

~> Note: This authentication method is tailored for the development experience.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm unsure if this should be before or after the header. It was hard to find an example of something similar. Let me know if it would look better below the header!

Copy link
Contributor

@kubawi kubawi Jan 24, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think either option looks good when it comes to aesthetics. For what's it worth, when looking at the page, I noticed that my eyes were immediately drawn to the title (Vault Agent Auto-Auth Token File Method) and I carried on reading from there – not really parsing the note. That makes me think that it could be more noticeable if placed after the header.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I'll make this change.

For production Agent installs, we recommend another authentication method.

# Vault Agent Auto-Auth Token File Method

peteski22 marked this conversation as resolved.
Show resolved Hide resolved
The `token_file` method reads in an existing, valid Vault token from a file, and uses that
token in lieu of authenticating itself. While it's a first class auto-auth method for all intents
and purposes, it naturally doesn't authenticate itself, as it requires a token from elsewhere. Like
other auto-auth methods, Agent will attempt to renew the token, as appropriate.

This auto-auth method is especially useful when testing Vault Agent without needing to set up
any authentication methods in Vault. For long-running Agent processes, we'd recommend another
auto-auth method, such that Agent is issuing its own authentication requests to Vault.

## Configuration

- `token_file_path` `(string: required)` - The path to the file with the token inside. This token cannot be a wrapping token.

## Example Configuration

An example configuration, using the `token_file` method to enable [auto-auth](/docs/agent/autoauth), follows:

```hcl
pid_file = "./pidfile"

vault {
address = "https://127.0.0.1:8200"
}

auto_auth {
method {
type = "token_file"

config = {
token_file_path = "~/.vault-token"
}
}
}


api_proxy {
use_auto_auth_token = true
}

listener "tcp" {
address = "127.0.0.1:8100"
tls_disable = true
}

template {
source = "/etc/vault/server.key.ctmpl"
destination = "/etc/vault/server.key"
}

template {
source = "/etc/vault/server.crt.ctmpl"
destination = "/etc/vault/server.crt"
}
```
4 changes: 4 additions & 0 deletions website/data/docs-nav-data.json
Original file line number Diff line number Diff line change
Expand Up @@ -901,6 +901,10 @@
{
"title": "Kubernetes",
"path": "agent/autoauth/methods/kubernetes"
},
{
"title": "Token File",
"path": "agent/autoauth/methods/token_file"
}
]
},
Expand Down