-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
VAULT-12564 Docs for token file auth method #18783
Merged
Merged
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
6156195
VAULT-12564 Docs for token file auth method
VioletHynes a702e91
VAULT-12564 fix typo
VioletHynes 7d4e77f
VAULT-12564 nav data
VioletHynes be87eff
VAULT-12564 Add note, remove token file removal config
VioletHynes e676344
VAULT-12564 stronger wording
VioletHynes b5b7b2b
VAULT-12564 auth -> auto-auth
VioletHynes File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -77,7 +77,7 @@ auto_auth { | |
} | ||
cache { | ||
api_proxy { | ||
use_auto_auth_token = true | ||
} | ||
|
65 changes: 65 additions & 0 deletions
65
website/content/docs/agent/autoauth/methods/token_file.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,65 @@ | ||
--- | ||
layout: docs | ||
page_title: Vault Agent Auto-Auth Token File Method | ||
description: Token File Method for Vault Agent Auto-Auth | ||
--- | ||
|
||
~> Note: This authentication method is tailored for the development experience. | ||
For production Agent installs, we recommend another authentication method. | ||
|
||
# Vault Agent Auto-Auth Token File Method | ||
|
||
peteski22 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
The `token_file` method reads in an existing, valid Vault token from a file, and uses that | ||
token in lieu of authenticating itself. While it's a first class auto-auth method for all intents | ||
and purposes, it naturally doesn't authenticate itself, as it requires a token from elsewhere. Like | ||
other auto-auth methods, Agent will attempt to renew the token, as appropriate. | ||
|
||
This auto-auth method is especially useful when testing Vault Agent without needing to set up | ||
any authentication methods in Vault. For long-running Agent processes, we'd recommend another | ||
auto-auth method, such that Agent is issuing its own authentication requests to Vault. | ||
|
||
## Configuration | ||
|
||
- `token_file_path` `(string: required)` - The path to the file with the token inside. This token cannot be a wrapping token. | ||
|
||
## Example Configuration | ||
|
||
An example configuration, using the `token_file` method to enable [auto-auth](/docs/agent/autoauth), follows: | ||
|
||
```hcl | ||
pid_file = "./pidfile" | ||
|
||
vault { | ||
address = "https://127.0.0.1:8200" | ||
} | ||
|
||
auto_auth { | ||
method { | ||
type = "token_file" | ||
|
||
config = { | ||
token_file_path = "~/.vault-token" | ||
} | ||
} | ||
} | ||
|
||
|
||
api_proxy { | ||
use_auto_auth_token = true | ||
} | ||
|
||
listener "tcp" { | ||
address = "127.0.0.1:8100" | ||
tls_disable = true | ||
} | ||
|
||
template { | ||
source = "/etc/vault/server.key.ctmpl" | ||
destination = "/etc/vault/server.key" | ||
} | ||
|
||
template { | ||
source = "/etc/vault/server.crt.ctmpl" | ||
destination = "/etc/vault/server.crt" | ||
} | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm unsure if this should be before or after the header. It was hard to find an example of something similar. Let me know if it would look better below the header!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think either option looks good when it comes to aesthetics. For what's it worth, when looking at the page, I noticed that my eyes were immediately drawn to the title (Vault Agent Auto-Auth Token File Method) and I carried on reading from there – not really parsing the note. That makes me think that it could be more noticeable if placed after the header.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks! I'll make this change.