luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Point people in the right direction for tokens used in transit autounseal. (#16951)

This commit is contained in:
Nick Cabatoff 2022-08-31 10:37:25 -04:00 committed by GitHub
parent b21e06b917
commit 1997fbb73f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
website/content/docs/concepts/tokens.mdx
View File

@ -29,8 +29,9 @@ holder is allowed to do within Vault. Other mapped information includes
metadata that can be viewed and is added to the audit log, such as creation
time, last renewal time, and more.
Read on for a deeper dive into token concepts.
Read on for a deeper dive into token concepts. See the
[tokens tutorial](https://learn.hashicorp.com/tutorials/vault/tokens)
for details on how these concepts play out in practice.
## Token Types

6
website/content/docs/configuration/seal/transit.mdx
View File

@ -113,6 +113,12 @@ path "<mount path>/decrypt/<key name>" {
}
```
Other considerations for the token used:
* it should probably be an [orphan token](/docs/concepts/tokens#token-hierarchies-and-orphan-tokens),
otherwise when the parent token expires or gets revoked the seal will break.
* consider making it a [periodic token](/docs/concepts/tokens#periodic-tokens)
and not setting an explicit max TTL, otherwise at some point it will cease to be renewable.
## Key Rotation
This seal supports key rotation using the Transit Secret Engine's key rotation endpoints. See