Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: update agent template certificate section #16573

Merged
merged 3 commits into from
Aug 10, 2022
Merged

docs: update agent template certificate section #16573

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1b02556
docs: update agent template certificate section
calvn Aug 4, 2022
eebab4d
extend template language section
calvn Aug 8, 2022
b458a63
make recommendation to use pkiCert over secret
calvn Aug 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 26 additions & 10 deletions website/content/docs/agent/template.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,16 +226,32 @@ this by inspecting the secret's time-to-live (TTL).

### Certificates

If a secret is a [certificate](/docs/secrets/pki), Vault Agent template will fetch the new certificate
using the certificates `validTo` field.

This does not apply to certificates generated with `generate_lease: true`. If set
Vault Agent template will apply the non-renewable, leased secret rules.

-> **Note** When Agent's auto-auth re-authenticates, due to a token expiry for
example, it generates a new token for Agent's use. This triggers a template
server restart, which fetches and re-renders a new set of certificates even if
existing certificates are valid.
#### Rendering using the `secret` template function

If a [certificate](/docs/secrets/pki) is rendered using the `secret` template
function, Vault Agent template will have the following fetching and re-rendering
behaviors on certificates:

- Fetches a new certificate on Agent startup, even if previously rendered
certificates are still valid.
- If `generate_lease` is unset or set to `false`, it uses the certificate's
`validTo` field to determine re-fetch interval.
- If `generate_lease` is set to `true`, apply the non-renewable, leased secret
rules.
- On Agent's auto-auth re-authentication, due to a token expiry for example, it
fetches and re-renders a new certificate even if the existing certificate is
valid.

#### Rendering using the `pkiCert` template function
calvn marked this conversation as resolved.
Show resolved Hide resolved

If a [certificate](/docs/secrets/pki) is rendered using the `pkiCert` template
function, Vault Agent template will have the following fetching and re-rendering
behaviors on certificates:

- Fetches a new certificate on Agent startup if none has been previously
rendered or the current rendered one has expired.
- On Agent's auto-auth re-authentication, due to a token expiry for example,
skip fetching unless the current rendered one has expired.

## Templating Configuration Example

Expand Down