Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE REQUEST] Vault: Distribute authentication details using response wrapping #62828

Closed
lkubb opened this issue Oct 6, 2022 · 0 comments · Fixed by #62684
Closed

[FEATURE REQUEST] Vault: Distribute authentication details using response wrapping #62828

lkubb opened this issue Oct 6, 2022 · 0 comments · Fixed by #62684
Labels
Feature new functionality including changes to functionality and code refactors, etc. needs-triage Vault

Comments

@lkubb
Copy link
Contributor

lkubb commented Oct 6, 2022

Is your feature request related to a problem? Please describe.
The Salt master fetches Vault authentication details in plaintext and distributes them over its own channels, even though Vault provides an integrated mechanism specifically for this purpose: response wrapping.

Describe the solution you'd like
The Salt master should request wrapped responses and distribute the resulting response wrapping tokens to minions. They can then request the secret from Vault directly, ensuring integrity, secrecy and auditability.

Describe alternatives you've considered
Keep distributing the data as is.

Additional context
https://learn.hashicorp.com/tutorials/vault/pattern-approle?in=vault/recommended-patterns#anti-patterns (Mostly tangential since the Salt master needs to be 100% trusted anyways, but mentions auditability).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature new functionality including changes to functionality and code refactors, etc. needs-triage Vault
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants