search

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
30.98k stars 4.19k forks source link

Clarify docs regarding Consul Engine rules #8481

Open tommyalatalo opened 4 years ago

tommyalatalo commented 4 years ago

The Consul Secrets Engine usage is documented to require loading of policies into the engine which you can then check out as dynamic tokens.

It seems however that no Consul "xxxx_prefix" actually work when using these in the Consul engine, this is not stated anywhere in the docs.

So instead of using node_prefix = "" { policy = "read" } you always have to use the direct way of node = "" { policy = "read" }

aphorise commented 2 years ago

There's been a number of changes since this request was raised and I feel that it may no longer be relevant - or I may be missing something to properly understand the use-case. I could not see any correlating parameter from the available description in this issue to what's noted on current the API or Docs:

Hey @altosys can you kindly elaborate how or if this is still relevant for you?

tommyalatalo commented 2 years ago

This is sill relevant I think, using node_prefix is still in the examples seen here: https://learn.hashicorp.com/tutorials/consul/vault-consul-secrets#create-a-consul-server-policy and in my experience using a prefix didn't work as described in my initial explanation above.