scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-01 11:08:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Point people in the right direction for tokens used in transit autounseal. (#16951)

Browse Source
This commit is contained in:
Nick Cabatoff
2022-08-31 10:37:25 -04:00
committed by GitHub
parent 0636467e5d
commit 4dc81554ce
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
website/content/docs/concepts/tokens.mdx
View File

@@ -29,8 +29,9 @@ holder is allowed to do within Vault. Other mapped information includes
metadata that can be viewed and is added to the audit log, such as creation
time, last renewal time, and more.
Read on for a deeper dive into token concepts.
Read on for a deeper dive into token concepts. See the
[tokens tutorial](https://learn.hashicorp.com/tutorials/vault/tokens)
for details on how these concepts play out in practice.
## Token Types

6
website/content/docs/configuration/seal/transit.mdx
View File

@@ -113,6 +113,12 @@ path "<mount path>/decrypt/<key name>" {
}
```
Other considerations for the token used:
* it should probably be an [orphan token](/docs/concepts/tokens#token-hierarchies-and-orphan-tokens),
otherwise when the parent token expires or gets revoked the seal will break.
* consider making it a [periodic token](/docs/concepts/tokens#periodic-tokens)
and not setting an explicit max TTL, otherwise at some point it will cease to be renewable.
## Key Rotation
This seal supports key rotation using the Transit Secret Engine's key rotation endpoints. See