{"action":"opened","issue":{"url":"https://api.github.com/repos/concourse/docs/issues/92","repository_url":"https://api.github.com/repos/concourse/docs","labels_url":"https://api.github.com/repos/concourse/docs/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/concourse/docs/issues/92/comments","events_url":"https://api.github.com/repos/concourse/docs/issues/92/events","html_url":"https://github.com/concourse/docs/issues/92","id":344270816,"node_id":"MDU6SXNzdWUzNDQyNzA4MTY=","number":92,"title":"Document how vault approle is used","user":{"login":"chrishiestand","id":100825,"node_id":"MDQ6VXNlcjEwMDgyNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/100825?v=4","gravatar_id":"","url":"https://api.github.com/users/chrishiestand","html_url":"https://github.com/chrishiestand","followers_url":"https://api.github.com/users/chrishiestand/followers","following_url":"https://api.github.com/users/chrishiestand/following{/other_user}","gists_url":"https://api.github.com/users/chrishiestand/gists{/gist_id}","starred_url":"https://api.github.com/users/chrishiestand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrishiestand/subscriptions","organizations_url":"https://api.github.com/users/chrishiestand/orgs","repos_url":"https://api.github.com/users/chrishiestand/repos","events_url":"https://api.github.com/users/chrishiestand/events{/privacy}","received_events_url":"https://api.github.com/users/chrishiestand/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-25T02:41:11Z","updated_at":"2018-07-25T02:41:11Z","closed_at":null,"author_association":"NONE","body":"If someone knowledgeable could fill in any gaps, I'd like to create a PR to address my own concerns with the documentation.\r\n\r\nWithout reading source code, it's difficult to tell how concourse uses the vault approle because the approle is somewhat complex and the concourse documentation is currently lacking some context. In particular we can help steer a vault admin creating an approle for concourse.\r\n\r\nI believe these are the approle parameters which may factor in:\r\n* `secret_id_num_uses`\r\n* `secret_id_ttl`\r\n* `token_num_uses`\r\n* `token_ttl`\r\n* `token_max_ttl`\r\n* `period`\r\n\r\nsource: https://www.vaultproject.io/api/auth/approle/index.html#secret_id_num_uses\r\n\r\nFrom what I gather (please let me know if this is wrong):\r\n\r\nWhen the ATC starts with `--vault-auth-backend approle` it does not have a, or load a previous, vault token. So for this reason the approle secret id is always required and should never expire. So `secret_id_ttl` and `secret_id_num_uses` should be set as null (empty string).\r\n\r\nThe ATC will then use the approle id and secret id to create a token, and will try to refresh that token after CONCOURSE_VAULT_AUTH_BACKEND_MAX_TTL. But it will never try to get a different token while the ATC process is running. Because the ATC process might run for 1 second or 5 years, you might as well treat this token as a lifetime periodic token. And so you should set `period` accordingly - something on the order of hours or days might give concourse time to renew its token despite faults/failures. Therefore you can set `token_ttl` and `token_max_ttl` as empty strings."}}
{"actor":{"display_login":"chrishiestand"}}