Create periodic token

Issue a renewable token with a 24h TTL for CI

vault token create -policy=read-only -period=24h -display-name=ci-pipeline
tool
vault31 commands
tags
vaultsecurityci

More vault commands

  • Enable Kubernetes auth method
    vault auth enable kubernetes && vault write auth/kubernetes/config kubernetes_host=https://kubernetes.default.svc

    Allow pods to authenticate with Vault via ServiceAccount JWT

  • Generate dynamic DB credentials
    vault read database/creds/readonly-role

    Obtain short-lived Postgres credentials from the database secrets engine

  • Seal / unseal Vault
    vault operator seal vault operator unseal $UNSEAL_KEY

    Manually seal or unseal Vault with an unseal key shard

  • Patch one KV field
    vault kv patch -mount=secret app api_key=<id>

    Update one field without rewriting the whole secret; note: kv patch needs KV-v2

  • Response wrapping handoff
    T=$(vault kv get -wrap-ttl=60s -field=wrapping_token -mount=secret app); vault unwrap $T

    Pass a secret as a single-use wrapping token; note: any reuse trips a security alarm

all 31 vault commands