digitalocean / digitalocean/doctl

Support for getting do_token from Vault

Open
#933 4 comments 1 reaction 0 assignees View on GitHub
suggestion
Dominant language
Go
Stars
3.4k
Forks
496
Avg merge
1d 2h
Merged PRs (30d)
31

Description

**What is the problem this feature would solve? Please describe.**
Now, `doctl` after auth init action, saves long-lived token for DO resources in a file system (config file).

**Describe the solution you'd like**
`doctl auth` should allow bypass the local storage and get the desired token from Vault repository. In that case, short-lived Vaults tokens will allow to getting long-lived. Similar features are available in terms of shadowing secrets on well-known cloud providers as with the AWS, Azure etc.

So the desired scenario might look like:
1. Call `doctl auth init` for getting Vault connection properties.
2. Call `vault login` in order to login into Vault (e.g. via OIDC provider, GitHub etc.)
3. Use `doctl` as usual, but in the background, `doctl` uses Vault client and honoured the default token from `~/.vault-token` in terms of getting target DO token.

**Additional context**
This suggestion improves significantly security in case of using `doctl` on the desktop env. It avoids storing DO tokens locally on fs.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.