mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-11-23 11:41:24 +01:00
Code Issues Projects Releases Wiki Activity
vault/website/source/docs/agent/autoauth/sinks/file.html.md
Jeff Malnick d430d5fa8a
Allow setting file mode on vault agent sink file (#7275) 
* feat: enable setting mode on vault agent sink file

* doc: update vault agent file sink with mode configuration
2019-08-21 20:41:55 -07:00

1.1 KiB
Raw Blame History

layout, page_title, sidebar_title, sidebar_current, description
layout page_title sidebar_title sidebar_current description
docs Vault Agent Auto-Auth File Sink File docs-agent-autoauth-sinks-file File sink for Vault Agent Auto-Auth

Vault Agent Auto-Auth File Sink

The file sink writes tokens, optionally response-wrapped and/or encrypted, to a file. This may be a local file or a file mapped via some other process (NFS, Gluster, CIFS, etc.).

Once the sink writes the file, it is up to the client to control lifecycle; generally it is best for the client to remove the file as soon as it is seen.

It is also best practice to write the file to a ramdisk, ideally an encrypted ramdisk, and use appropriate filesystem permissions. The file is currently written with 0640 permissions as default, but can be overridden with the optional 'mode' setting.

Configuration

  • path (string: required) - The path to use to write the token file
  • mode (int: optional) - A string containing an octal number representing the bit pattern for the file mode, similar to chmod. Set to "0000" to prevent Vault from modifying the file mode