Implement Secret Caching Using Vault Agent

Contributed by: Prachi Jain

Difficulty level: Intermediate

Vault Agent’s secret caching feature provides the capability of storing frequently accessed secrets locally on machines. This helps reduce the load on the Vault server and improve performance.

Prerequisites

You need the following:

1. A running Vault cluster: Refer to the Shortcut “Run HashiCorp Vault with Helm” for a refresher on running Vault.

2. A running vault-agent: Refer to the Shortcut “Run Vault Agent to Interact with HashiCorp Vault” for a refresher on running vault-agent with approle auth.

Enable Caching

1. On your client machine, update the vault-agent config file with the following:

   # vault-agent.hcl
   pid_file = "./pidfile"
   log_level = "debug"
   
   auto_auth {
     method "approle" {
       config = {
         role_id_file_path = "/etc/shortcuts/role-id"
         secret_id_file_path = "/etc/shortcuts/secret-id"
         remove_secret_id_file_after_reading = false
       }
     }
     
     sink "file" {
       config = {
         path = "/etc/shortcuts/token"
       }
     }
   }
   
   cache {
     use_auto_auth_token = true
   }
   
   listener "tcp" {
     address = "127.0.0.1:8100"
     tls_disable = true
   }
   
   vault {
     address = "http://127.0.0.1:8200"
   }
   
   template {
     source      = "/etc/shortcuts/my-secret.ctmpl"
     destination = "/etc/shortcuts/secrets.txt"
   }

   In the preceding config file, note the cache block that enables secret caching.

2. Run vault-agent with the updated config:

   vault agent -config=/etc/vault-agent.hcl -log-level=debug

   You should see log messages like the following:

   2024-07-26T16:38:38.385-0500 ...