mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-17 20:17:00 +02:00
f48c70a449
* VAULT-15546 First pass at Vault Proxy docs * VAULT-15546 correct errors * VAULT-15546 fully qualify paths * VAULT-15546 remove index * VAULT-15546 Some typos and clean up * VAULT-15546 fix link * VAULT-15546 Add redirects so old links stay working * VAULT-15546 more explicit redirects * VAULT-15546 typo fixes * Suggestions for Vault Agent & Vault Proxy docs (#20612) * Rename 'agentandproxy' to 'agent-and-proxy' for better URL * Update the index pages for each section * VAULT-15546 fix link typo --------- Co-authored-by: Yoko Hyakuna <yoko@hashicorp.com>
28 lines
1.3 KiB
Plaintext
28 lines
1.3 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Vault Agent and Vault Proxy Auto-Auth File Sink
|
|
description: File sink for Auto-Auth
|
|
---
|
|
|
|
# Vault Agent and Vault Proxy Auto-Auth File Sink
|
|
|
|
The `file` sink writes tokens, optionally response-wrapped and/or encrypted, to
|
|
a file. This may be a local file or a file mapped via some other process (NFS,
|
|
Gluster, CIFS, etc.).
|
|
|
|
Once the sink writes the file, it is up to the client to control lifecycle;
|
|
generally it is best for the client to remove the file as soon as it is seen.
|
|
|
|
It is also best practice to write the file to a ramdisk, ideally an encrypted
|
|
ramdisk, and use appropriate filesystem permissions. The file is currently
|
|
written with `0640` permissions as default, but can be overridden with the optional
|
|
'mode' setting.
|
|
|
|
## Configuration
|
|
|
|
- `path` `(string: required)` - The path to use to write the token file
|
|
- `mode` `(int: optional)` - A string containing an octal number representing the bit pattern for the file mode, similar to chmod. Set to `0000` to prevent Vault from modifying the file mode. Note: This configuration option is only available in Vault 1.3.0 and above.
|
|
|
|
~> Note: Configuration options for response-wrapping and encryption for the sink
|
|
file are located within the [options common to all sinks](/vault/docs/agent-and-proxy/autoauth#configuration-sinks) documentation.
|