Vault Agent Auto Authentication

48 Views Asked by At

In vault docs (https://developer.hashicorp.com/vault/docs/agent-and-proxy/agent) it was mentioned that one features of vault agent is Auto-Auth (Automatically authenticate to Vault and manage the token renewal process for locally-retrieved dynamic secrets).

My vault agent configuration:

pid_file = "F:/Vault/vault-agent/agent.pid"
log_file = "F:/Vault/vault-agent/trace.log"
vault {address = "http://127.0.0.1:8200"}
auto_auth {
  method "approle" {
    config = {
      role_id_file_path   = "F:/Vault/vault-agent/agent-role-id"
      secret_id_file_path = "F:/Vault/vault-agent/agent-secret-id"
      #remove_secret_id_file_after_reading = false
    }
  }
  sink "file" {
    config = {
      path = "F:/Vault/vault-agent/agent-token"
    }
  }
}
cache {
  use_auto_auth_token = true
}
listener "tcp" {
  address     = "127.0.0.1:8100"
  tls_disable = true
}

My vault server configuration:

disable_mlock = true
api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"
ui = true
pid_file = "F:/Vault/data/vault.pid"
log_file = "F:/Vault/data/trace.log"
storage "raft" {
  path    = "F:/Vault/data"
  node_id = "raft_node_id"
}
listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = "true"
}

what i have tried:

import hvac
client = hvac.Client(url='http://localhost:8100')
client.is_authenticated()

what i expected:

True

What actually appeared:

False

Vault Agent Log:

2024-03-05T04:35:06.403+0200 [INFO]  agent.sink.server: starting sink server
2024-03-05T04:35:06.403+0200 [INFO]  agent.auth.handler: authenticating
2024-03-05T04:35:06.922+0200 [INFO]  agent.auth.handler: authentication successful, sending token to sinks
2024-03-05T04:35:06.924+0200 [INFO]  agent.sink.file: token written: path=F:/Vault/vault-agent/agent-token
2024-03-05T04:35:06.932+0200 [INFO]  agent.auth.handler: starting renewal process
2024-03-05T04:35:07.245+0200 [INFO]  agent.auth.handler: renewed auth token
2024-03-05T04:37:53.816+0200 [INFO]  agent.apiproxy: received request: method=GET path=/v1/auth/token/lookup-self
2024-03-05T04:37:53.817+0200 [INFO]  agent.apiproxy: forwarding request to Vault: method=GET path=/v1/auth/token/lookup-self
2024-03-05T05:17:18.781+0200 [INFO]  agent.auth.handler: renewed auth token
0

There are 0 best solutions below