diff --git a/website/source/docs/secrets/cubbyhole/index.html.md b/website/source/docs/secrets/cubbyhole/index.html.md new file mode 100644 index 0000000000..7960986df2 --- /dev/null +++ b/website/source/docs/secrets/cubbyhole/index.html.md @@ -0,0 +1,50 @@ +--- +layout: "docs" +page_title: "Secret Backend: Cubbyhole" +sidebar_current: "docs-secrets-cubbyhole" +description: |- + The cubbyhole secret backend can store arbitrary secrets scoped to a single token. +--- + +# Cubbyhole Secret Backend + +Name: `cubbyhole` + +The `cubbyhole` secret backend is used to store arbitrary secrets within +the configured physical storage for Vault. It is mounted at the `cubbyhole/` +prefix by default and cannot be mounted elsewhere or removed. + +This backend differs from the `generic` backend in that the `generic` backend's +values are accessible to any token with read privileges on that path. In this +backend, paths are scoped per token; no token can read secrets placed in +another token's cubbyhole. When the token expires, its cubbyhole is destroyed. + +Also unlike the `generic` backend, because the cubbyhole's lifetime is linked +to an authentication token, there is no concept of a lease or lease TTL for +values contained in the token's cubbyhole. + +Writing to a key in the `cubbyhole/` backend will replace the old value, +the sub-fields are not merged together. + +## Quick Start + +The `cubbyhole` backend allows for writing keys with arbitrary values. + +As an example, we can write a new key "foo" to the `cubbyhole` backend, which +is mounted at `cubbyhole/`: + +``` +$ vault write cubbyhole/foo zip=zap +Success! Data written to: cubbyhole/foo +``` + +This writes the key with the "zip" field set to "zap". We can test this by doing +a read: + +``` +$ vault read cubbyhole/foo +Key Value +zip zap +``` + +As expected, the value previously set is returned to us. diff --git a/website/source/layouts/docs.erb b/website/source/layouts/docs.erb index ce343b65f4..ca39762f1e 100644 --- a/website/source/layouts/docs.erb +++ b/website/source/layouts/docs.erb @@ -105,25 +105,33 @@ AWS + > + Cassandra + + > Consul - > - PKI (Certificates) - + > + Cubbyhole + - > - PostgreSQL - + > + Generic + > MySQL - > - Cassandra - + > + PKI (Certificates) + + + > + PostgreSQL + > SSH @@ -133,10 +141,6 @@ Transit - > - Generic - - > Custom @@ -146,26 +150,14 @@ > Auth Backends