hashicorp / hashicorp/consul-template
Support export of latest public key from the Vault Transit Engine
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
# Which problem is this feature request solving?
We use Vault [Transit Secret Engine](https://developer.hashicorp.com/vault/api-docs/secret/transit) to generate asymmetric keys. We would like to inject the current/latest generated public key into a k8s Pod. The injection happens via [Vault Agent Sidecar Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector) and annotation based Consul-template injection.
# Describe the solution you'd like
We would like to have a new template function `transit ` where PATH is a path to a Transit Secret Engine, which points to the latest key. e.g. : `transit/export/public-key/fookey/latest`
Then we could inject the secret like this:
```yaml
apiVersion: ...
kind: ...
spec:
annotation:
vault.hashicorp.com/agent-inject-secret-signing_key: |
{{ with transit "transit/export/public-key/signing_key/latest" }}
{{ .Data.key }}
{{ end }}
```
# Can you submit a pull request?
No.
Contributor guide
Research direction
The requested entry point is a new `transit ` template function for Vault Transit public-key export, used through Vault Agent Sidecar Injector annotations. Start by tracing how Consul Template exposes Vault-backed template functions and consult the linked Transit API documentation. Done means the latest public key can be rendered through the proposed template syntax; the issue names no repository files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- cloud, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100