README
¶
Automatic Vault Token Injector
vault-token-injector
A loop to keep vault access tokens up-to-date in circleci and/or terraform cloud
Injects new tokens into circleci build environments or terraform cloud workspaces on startup and every 30 minutes. Also injects the VAULT_ADDR variable.
Configuration
An example configuration file is present here. Whatever circleci projects or terraform cloud workspaces are mentioned will update the given token_variable in the project workspace. The vault token for that project is created with the provided vault_role and/or vault_policies. In addition, the vault_address field is injected as the VAULT_ADDR environment variable.
Token TTL and Refresh Interval
The default token TTL is 60 minutes, and the default refresh interval is 30 minutes. This allows some overlap intentionally. If you wish to customize these numbers, you can set the following in your configuration:
token_ttl: 10m
token_refresh_interval: 1m
Logging
You can adjust the logging level with the -vX flag where X can be 1-10.
WARNING - Log level 10 will output secrets into the logs for debugging scenarios. Please do not do this in a production environment.
Note that the time intervals are golang time.Duration strings
Future Planned Enhancements
- Staggered token injections
- Disable
VAULT_ADDRinjection - Use Vault API instead of vault binary
- Prometheus endpoint to bubble up errors and successes
Documentation
¶
Overview ¶
Copyright © 2021 FairwindsOps
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Source Files
Directories