Skip to content

Commit 1c70a84

Browse files
authored
Update README.md (#2)
1 parent 89273e9 commit 1c70a84

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

README.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,19 @@
11
# Batch DR Operation Token Generator for Vault Enterprise on Kubernetes
2-
This offers an option to reduce extra labor for Vault Enterprise operator. Vault Enterprise provides Disaster Recovery (DR) replication feature, and this feature is one of the big advantages of using it. If a failure actually occures, currently we have two options to promote a DR secondary cluster to a new primary. The first is to use a DR operation token, and the other is a batch DR operation token. Don't mention the differences here, so please read [this docs](https://developer.hashicorp.com/vault/tutorials/enterprise/disaster-recovery#dr-operation-token-strategy). For most cases, a batch DR operation token should be preferable because it has explicit TTL, and no necessary to scramble to prepare for unseal keys or recovery keys at that time. Especially, it will shine when these operations are outsourced as a DR operation token needs an extra step to revoke the token after the operation.
2+
This offers an option to reduce extra labor for Vault Enterprise operator. Vault Enterprise provides Disaster Recovery (DR) replication feature, and this feature is one of the big advantages of using it. If a failure actually occurs, currently we have two options to promote a DR secondary cluster to a new primary. The first is to use a DR operation token, and the other is a batch DR operation token. Don't mention the differences here, so please read [this docs](https://developer.hashicorp.com/vault/tutorials/enterprise/disaster-recovery#dr-operation-token-strategy). For most cases, a batch DR operation token should be preferable because it has explicit TTL, and no necessary to scramble to prepare for unseal keys or recovery keys at that time. Especially, it will shine when these operations are outsourced as a DR operation token needs an extra step to revoke the token after the operation.
33

44
# Usage
55
This supports only for Kubernetes Auth so far, and Google Cloud Storage(GCS) and Amazon S3 are only supported as the token storage. Please see [examples](./example/cronjob.yaml) for more details.
66

7-
## Congigurations
7+
## Configurations
88
- `--kubernetes-auth-role` `(string: required)` - Role to use for authenticating to Vault.
99
- `--service-account-token-path` `(string: "/var/run/secrets/kubernetes.io/serviceaccount/token")` - Path to where your application's Kubernetes service account token is mounted,
1010
- `--batch-token-role` `(string: required)` - Token role for failover operations. Its type should be `batch`.
1111
- `--batch-token-ttl` `(string: "8h")` - TTL of the batch DR operation token. When executing as Cronjob, make sure that the overlap period of two or more tokens is long enough for the DR operation.
1212
- `--bucket-url` `(string: required)` - The URL of Cloud Storage. Currently, Google Cloud Storage(GCS) and Amazon S3 are only supported. e.g. `gs://vault-bdrtoken`
1313

1414
## Environment variables
15-
16-
### `VAULT_ADDR`
17-
Address of the Vault server expressed as a URL and port, for example:
18-
`https://127.0.0.1:8200/`.
15+
Environment variables related to Vault API are defined in
16+
[`api/client.go`](https://github.com/hashicorp/vault/blob/main/api/client.go).
1917

2018
### `TZ`
2119
Timezone for the file name and its metadata. Please see the supported [zones](https://github.com/arp242/tz/blob/bf333631bec4/list.go), for example:

0 commit comments

Comments
 (0)