Support for a "token-only" injection annotation #77
Conversation
The annotation `"vault.hashicorp.com/agent-inject-token": "true"` results in a `token` file containing the `lookup-self` token.
agent-inject/agent/config.go
Outdated
| @@ -8,6 +8,8 @@ import ( | |||
|
|
|||
| const ( | |||
| DefaultTemplate = "{{ with secret \"%s\" }}{{ range $k, $v := .Data }}{{ $k }}: {{ $v }}\n{{ end }}{{ end }}" | |||
| TokenTemplate = `{{ with secret "auth/token/lookup-self" }}{{ .Data.id }}{{ end }}` | |||
There was a problem hiding this comment.
One small request: add a newline to the end of the .Data.id line (like the default template) because if you were to look at it in the container:
/vault/secrets $ ls
ca.cert db-creds server.cert server.key token
/vault/secrets $ cat token
s.gXuAjfknTq0dK1i5s5rsjxpI/vault/secrets $
There was a problem hiding this comment.
Hmm, it's literally writing the \n characters, not a new line.
agent-inject/agent/annotations.go
Outdated
| @@ -35,6 +35,10 @@ const ( | |||
| // If not provided, a default generic template is used. | |||
| AnnotationAgentInjectTemplate = "vault.hashicorp.com/agent-inject-template" | |||
|
|
|||
| // AnnotationAgentInjectToken is the annotation key for injecting the token | |||
| // from auth/token/lookup-self | |||
| AnnotationAgentInjectToken = "vault.hashicorp.com/agent-inject-token-only" | |||
There was a problem hiding this comment.
I wonder if vault.hashicorp.com/agent-inject-token-only is confusing: it suggests that we're only going to render a token. Maybe this should be renamed to agent-inject-share-token?
There was a problem hiding this comment.
How about just agent-inject-token?
| { | ||
| "valid inject-token-only", | ||
| map[string]string{ | ||
| "vault.hashicorp.com/agent-inject-token-only": "true", |
There was a problem hiding this comment.
Nit: use the annotation variable.
agent-inject-token-only --> agent-inject-token using annotation and config variables in tests
|
this might be a dumb question, my apologies. is the |
The annotation "vault.hashicorp.com/agent-inject-token": "true" results in a token file containing the lookup-self token.
The annotation
"vault.hashicorp.com/agent-inject-token": "true"results in a
tokenfile containing thelookup-selftoken.Resolves #16