luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Fix website formatting (#5576)

This commit is contained in:
Seth Vargo 2018-10-20 20:35:33 -04:00 committed by Jeff Mitchell
parent 64eaef49ad
commit 1fa851eeeb
2 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
website/source/docs/auth/gcp.html.md
View File

@ -258,9 +258,9 @@ curl \
#### gcloud Example
```text
gcloud beta iam service-accounts sign-jwt credentials.json - \
--iam-account=service-account@my-project.iam.gserviceaccount.com \
--project=my-project
$ gcloud beta iam service-accounts sign-jwt credentials.json - \
--iam-account=service-account@my-project.iam.gserviceaccount.com \
--project=my-project
```
#### Golang Example

40
website/source/docs/secrets/gcp/index.html.md
View File

@ -62,7 +62,7 @@ management tool.
If you are running Vault from inside [Google Compute Engine][gce] or [Google
Kubernetes Engine][gke], the instance or pod service account can be used in
place or specifying the credentials JSON file.
place or specifying the credentials JSON file.
For more information on authentication, see the [authentication section](#authentication) below.
1. Configure a roleset. Rolesets determine the permissions that Service Account
@ -94,9 +94,9 @@ credentials generated by Vault will have on GCP resources.
}
EOF
```
Alternatively, provide a file for the `bindings` argument like so:
Alternatively, provide a file for the `bindings` argument like so:
```text
$ vault write gcp/roleset/my-roleset
bindings=@mybindings.hcl
@ -121,21 +121,21 @@ was configured, you can generate OAuth2 tokens or service account keys.
To generate OAuth2 tokens, read from `gcp/token/...`. The roleset must have been
created as type `access_token`:
```text
$ vault read gcp/token/my-token-roleset
Key Value
--- -----
expires_at_seconds 1537402548
token ya29.c.ElodBmNPwHUNY5gcBpnXcE4ywG4w1k...
token_ttl 3599
```
```text
$ vault read gcp/token/my-token-roleset
Key Value
--- -----
expires_at_seconds 1537402548
token ya29.c.ElodBmNPwHUNY5gcBpnXcE4ywG4w1k...
token_ttl 3599
```
This endpoint generates a non-renewable, non-revocable static OAuth2 access token
with a lifetime of one hour, where `token_ttl` is given in seconds and the
`expires_at_seconds` is the expiry time for the token, given as a Unix timestamp.
The `token` value then can be used as a HTTP Authorization Bearer token in requests
to GCP APIs:
with a lifetime of one hour, where `token_ttl` is given in seconds and the
`expires_at_seconds` is the expiry time for the token, given as a Unix timestamp.
The `token` value then can be used as a HTTP Authorization Bearer token in requests
to GCP APIs:
```sh
$ curl -H "Authorization: Bearer ya29.c.ElodBmNPwHUNY5gcBpnXcE4ywG4w1k..."
@ -345,7 +345,7 @@ Advantages of `access_tokens`:
Disadvantages of `access_tokens`:
* Cannot be used with some client libraries or tools
* Have a static life-time of 1 hr that cannot be modified, revoked, or extended.
* Have a static life-time of 1 hr that cannot be modified, revoked, or extended.
Advantages of `service_account_keys`:
* Controllable life-time through Vault, allowing for longer access
@ -353,7 +353,7 @@ Advantages of `service_account_keys`:
Disadvantages of `service_account_keys`:
* Infinite lifetime in GCP (i.e. if they are not managed properly, leaked keys can live forever)
* Limited to 10 per roleset/service account.
* Limited to 10 per roleset/service account.
When generating OAuth access tokens, Vault will still
generate a dedicated service account and key. This private key is stored in Vault
@ -457,7 +457,7 @@ for more details.
## Upgrade Guides
### Deprecation of Access Token Leases
### Deprecation of Access Token Leases
~> **NOTE**: This only affects access tokens. There is no change to the `service_account_key` secret type