Fabio: Fabio and Vault Token Issues

[erenfro]

Hello.

I recently had a case where Fabio stopped providing SSL because the token expired and was no longer renewable. This concerns me because, well, tokens all have a similar time-to-live life span which requires constant renewing in order to keep them active, as my understanding anyway.

Vault has an alternative to this which is approles. SaltStack recently implemented approle support for the very same reason I mentioned here, renewing tokens and expirations.

Maybe Fabio should make use of this approle option as well, which requires a role_id and a secret_id, and not just a token id.

[erenfro]

@magiconair Yep. I looked further into this and vault, at least with 0.9.1 and up, has a default token max_lease_ttl of 32 days, so this poses a serious problem having to constantly renew, manually, these tokens for an application such as this, which as a result, also requires restarting the fabio service when changing the token.

[volym3ad]

Also faced with this problem... Restart of fabio helped but this is not an option. @magiconair what do you think about this?

[magiconair]

I'm not a vault expert. @pschultz do you have an idea?

[leprechau]

The current vendored vault version is v0.6.0 which is quite old. I can look at getting that updated to the latest release in preparation for vault v1.0 that appears to be right around the corner. That should at least give us a more modern starting point for possible refactor/improvement if needed.

[pschultz]

We are running our fabio instances with periodic tokens, which never expire:

$ vault token create -help 2>&1 | grep -A3 period
  -period=<duration>
      If specified, every renewal will use the given period. Periodic tokens
      do not expire (unless -explicit-max-ttl is also provided). Setting this
      value requires sudo permissions. This is specified as a numeric string
      with suffix like "30s" or "5m".

This is what such a token looks like. Note that the token has been issued much earlier than 32 days ago but the last renewal happened today. Our Vault server uses the standard max_lease_ttl:

$ vault token lookup -accessor 9f0bbc18-2b02-c936-7a3f-c1b0e2443586
Key                  Value
---                  -----
accessor             9f0bbc18-2b02-c936-7a3f-c1b0e2443586
creation_time        1530181359
creation_ttl         259200
display_name         token
entity_id            n/a
expire_time          2018-11-19T02:41:22.742165478Z
explicit_max_ttl     0
id                   n/a
issue_time           2018-06-28T10:22:39.082648509Z
last_renewal         2018-11-16T02:41:22.742165886Z
last_renewal_time    1542336082
meta                 <nil>
num_uses             0
orphan               false
path                 auth/token/create
period               259200
policies             [default fabio]
renewable            true
ttl                  234363

That being said, supporting AppRoles isn't a bad idea, for flexibility. However I don't have time to work on this myself in the foreseeable future.

[magiconair]

Would it make sense to add this to the documentation? https://fabiolb.net/feature/vault/

[murphymj25]

Would it be an option to have Fabio watch for changes to the token in a file? This way the token could be updated without having to restart. I think we're going to need to do something like this since we won't be able to get tokens that won't expire. We can create a PR once we have a working solution. Let me know if there are any suggestions or concerns with this approach.

[murphymj25]

I have a working solution to have the token pulled in from a file at every vault refresh interval. This allows me to use other automated means to refresh the token without having to restart the process. I'll try and get a PR out there early next week.

[pschultz]

That would be great, in particular for setups where fabio runs in a Nomad cluster. Nomad already provides the Vault token in a file (in addition to the environment variable) and updates that file if necessary.

[murphymj25]

@pschultz I just created a pull request, #620.