hashicorp / hashicorp/consul-template

Support export of latest public key from the Vault Transit Engine

Open
#1,871 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

# Which problem is this feature request solving?

We use Vault [Transit Secret Engine](https://developer.hashicorp.com/vault/api-docs/secret/transit) to generate asymmetric keys. We would like to inject the current/latest generated public key into a k8s Pod. The injection happens via [Vault Agent Sidecar Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector) and annotation based Consul-template injection.

# Describe the solution you'd like

We would like to have a new template function `transit ` where PATH is a path to a Transit Secret Engine, which points to the latest key. e.g. : `transit/export/public-key/fookey/latest`

Then we could inject the secret like this:
```yaml
apiVersion: ...
kind: ...
spec:
annotation:
vault.hashicorp.com/agent-inject-secret-signing_key: |
{{ with transit "transit/export/public-key/signing_key/latest" }}
{{ .Data.key }}
{{ end }}

```

# Can you submit a pull request?

No.

Contributor guide

Open the contributing guide

Research direction

The requested entry point is a new `transit ` template function for Vault Transit public-key export, used through Vault Agent Sidecar Injector annotations. Start by tracing how Consul Template exposes Vault-backed template functions and consult the linked Transit API documentation. Done means the latest public key can be rendered through the proposed template syntax; the issue names no repository files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
cloud, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.