Closed zwiebelspaetzle closed 4 years ago
For reading secrets (get
) and monitor the token expiration (token-lookup
) you do not need a root token.
In general you just need a token associated to a policy just allowing the actions you need.
For instance the get
command need a token able to read in a sub-tree of secret/
.
The token-lookup
method works with any given token of course.
Conversely the method policy
requires a root token or the appropriate rights.
It's not necessary to execute this binary as root, only a simple execution right.
The readme uses the root token of a dev setup. In prod, what are the minimum permissions needed for this script to run?