Allow vault agent accept config directory

[derbenevivan]

Currently vault agent accepts only a file in -config argument of CLI

Compiling vault-agent configuration from different sources (like multiple ansible roles) can be a pain, if we use only a single config file

Adding a possibility to move multiple template{} stanzas or even sink{} to a different files will help managing multiple templates
Like it's done, for example, in consul-template

[aphorise]

What should happen in scenarios where there are multiple agent specific .hcl files at the given path? (ie which should it use & why?).

[derbenevivan]

@aphorise how it's done in consul-template?
seems that smth like this:
https://github.com/hashicorp/consul-template/pull/74/files
I imagine that would be simple merging of all files from directory into one.
If vault agent doesn't support multiple vault{} stanzas, for instance, that would return exactly the same error, as when the single file had multiple vault{} stanzas

I assume that adding multiple agent specific vault agent configs to a single folder and at the same time specifying this folder as a config source will be considered a misconfiguration.

As i see, this will be 100% backwards compatible, because now nobody can specify a folder as a config source, and won't have any issues if their vault agent is pointing at /path/vault-config.hcl

[rrauenza]

Or what if it was done like sudoers?

include_templates = "/etc/vault-agent.d/templates.d/" ?

Each included template could either be required to ... or required not to... have the template { } stanza.

Or supervisor.d, where you give a filespec:

[include]
files = supervisord.d/*.ini

So,

include_templates = "/etc/vault-agent.d/templates.d/*.conf"

(My particular pain point is ansible needing to drop different templates.. the main config can be done as a single different role.)

[aphorise]

The issue I was actually getting at were clashes and what should happen in case of multiple .hcl with the same scope that for example vary only in the vault address used? - as is for example common when configs may be update on a new file on the same path to reflect minor changes?

[rjhornsby]

As far as configuration conflicts, server mode already supports the desired behavior of being able to provide multiple -config args, as does consul. However they're solving it seems reasonable.

Vault - but specifically in agent mode - is the odd one out here it seems.

[peteski22]

Should now be resolved by #18403