mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-14 10:37:00 +02:00
128 lines
3.8 KiB
Plaintext
128 lines
3.8 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: agent generate-config - Command
|
|
description: |-
|
|
Generates a simple Vault Agent configuration file from the given parameters.
|
|
---
|
|
|
|
# agent generate-config
|
|
|
|
Generates a simple Vault Agent configuration file from the given parameters.
|
|
|
|
Currently, the only supported configuration type is `env-template`, which
|
|
helps you generate a configuration file with environment variable templates
|
|
for running Vault Agent in
|
|
[process supervisor](/vault/docs/agent-and-proxy/agent/process-supervisor)
|
|
mode.
|
|
|
|
For every specified secret `-path`, the command will attempt to generate one or
|
|
multiple `env_template` entries based on the `JSON` key(s) stored in the
|
|
specified secret. If the secret `-path` ends with `/*`, the command will
|
|
attempt to recurse through the secrets tree rooted at the given path,
|
|
generating `env_template` entries for each encountered secret. Currently,
|
|
only [kv-v1](/vault/docs/secrets/kv/kv-v1) and
|
|
[kv-v2](/vault/docs/secrets/kv/kv-v2) paths are supported.
|
|
|
|
The command specified in the `-exec` option will be used to generate an
|
|
`exec` entry, which will tell Vault Agent which child process to run.
|
|
|
|
In addition to the `env_template` entries, the command generates an `auto_auth`
|
|
section with `token_file` authentication method. While this method is very
|
|
convenient for local testing, it should **NOT** be used in production. In a
|
|
production environment, please use any other
|
|
[Auto-Auth method](/vault/docs/agent-and-proxy/autoauth/methods) instead.
|
|
|
|
By default, the file will be generated in the local directory as `agent.hcl`
|
|
unless a path is specified as an argument.
|
|
|
|
## Example
|
|
|
|
Before generating a configuration file, let's insert a secret `foo`:
|
|
|
|
```shell-session
|
|
$ vault kv put -mount=secret foo user="admin" password="s3cr3t"
|
|
```
|
|
|
|
Generate an agent configuration file which will reference `secret/foo`:
|
|
|
|
```shell-session
|
|
$ vault agent generate-config \
|
|
-type="env-template" \
|
|
-exec="./my-app arg1 arg2" \
|
|
-namespace="my/ns/" \
|
|
-path="secret/foo" \
|
|
my-config.hcl
|
|
```
|
|
|
|
**Expected output:**
|
|
|
|
<CodeBlockConfig hideClipboard>
|
|
|
|
```plaintext
|
|
Successfully generated "my-config.hcl" configuration file!
|
|
Warning: the generated file uses 'token_file' authentication method, which is not suitable for production environments.
|
|
```
|
|
|
|
</CodeBlockConfig>
|
|
|
|
This will produce `my-config.hcl` file in the current directory with contents
|
|
similar to the following:
|
|
|
|
```hcl
|
|
auto_auth {
|
|
|
|
method {
|
|
type = "token_file"
|
|
|
|
config {
|
|
token_file_path = "/Users/avean/.vault-token"
|
|
}
|
|
}
|
|
}
|
|
|
|
template_config {
|
|
static_secret_render_interval = "5m"
|
|
exit_on_retry_failure = true
|
|
}
|
|
|
|
vault {
|
|
address = "http://localhost:8200"
|
|
}
|
|
|
|
env_template "FOO_PASSWORD" {
|
|
contents = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.password }}{{ end }}"
|
|
error_on_missing_key = true
|
|
}
|
|
env_template "FOO_USER" {
|
|
contents = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.user }}{{ end }}"
|
|
error_on_missing_key = true
|
|
}
|
|
|
|
exec {
|
|
command = ["./my-app", "arg1", "arg2"]
|
|
restart_on_secret_changes = "always"
|
|
restart_stop_signal = "SIGTERM"
|
|
}
|
|
```
|
|
|
|
## Usage
|
|
|
|
The following flags are available in addition to the [standard set of
|
|
flags](/vault/docs/commands) included in all commands.
|
|
|
|
- `type` `(string: <required>)` - The type of configuration file to generate;
|
|
currently, only `env-template` is supported.
|
|
|
|
- `path` `(string: "")` - Path to a kv-v1 or kv-v2 secret
|
|
(e.g. `secret/data/foo`, `kv-v2/my-app/*`); multiple secrets and tail `*`
|
|
wildcards are allowed.
|
|
|
|
- `-exec` `(string: "env")` - The command to execute in agent process
|
|
supervisor mode.
|
|
|
|
|
|
## Tutorial
|
|
|
|
Refer to the [Vault Agent - secrets as environment
|
|
variables](/vault/tutorials/vault-agent/agent-env-vars) tutorial for an
|
|
end-to-end example. |