Add 'iam_alias' and 'gce_alias' fields to API docs #8822
Conversation
| @@ -164,6 +169,11 @@ The following parameters are only valid when the role is of type `"gce"`: | |||
| GCP labels are not currently ACL'd, we recommend that this be used in | |||
| conjunction with other restrictions. | |||
|
|
|||
| - `gce_alias` `(string: instance_id)` - Must be either `instance_id` or `role_id`. | |||
| If `instance_id` is specified, the GCE instance ID will be used for alias names. | |||
There was a problem hiding this comment.
Should the performance implications of using instance_id be mentioned? Something like "Many unique GCE instances over time can cause severe performance issues on authentication that can also affect the reliability of Vault."
There was a problem hiding this comment.
I'm torn on whether to do this, mainly because the performance issue comes when you have an alias, and its metadata fields change a lot. There's further discussion of it in this PR: #8783. I'm going to do a quick follow-on PR adding the ability to configure what metadata fields are used as well, and I'd be happy to document which are riskier for each alias as part of it.
There was a problem hiding this comment.
I lean away from mentioning performance implications because it is very use-case dependent. If we do add any notes about performance, I think it would be better to include it in @tyrannosaurus-becks 's follow on PR for configuring metadata.
There was a problem hiding this comment.
We observed large numbers of entities created with aliases that have unique names and no metadata as well. In this case, the name includes the instance id which is unique, so a new entity will be created for every GCE instance over time.
pcman312
changed the title
Docs for hashicorp/vault-plugin-auth-gcp#89.
Adds the
iam_aliasandgce_aliasfields to the API docs for GCP auth.