vault agent enforce auto auth token

[lcgkm]

Is your feature request related to a problem? Please describe.
We have many application based on Spring Vault Cloud 1.1.3. We want to migrate to kubernetes and use Vault Agent Caching as 'sidecar' container.
But as we know:

1. For Spring Vault Cloud, a Vault token is mandatory. We can't set empty token.
2. For Vault agent caching. If the requests already bear a token, this configuration will be overridden and the token in the request will be used to forward the request to the Vault server.
   https://www.vaultproject.io/docs/agent/caching/index.html#configuration-cache-

We want make sure the requests made to vault agent will be always forwarded to the Vault server with the auto-auth token attached.

Describe the solution you'd like
Could we provide new configuration flag, like use_auto_auth_token_enforce?

[jefferai]

It feels like the right solution is to instead patch Spring Vault to allow an empty token.

[lcgkm]

Hi @jefferai ,
Spring Vault will be coupled with source code. And vault agent is 'sidecar' component.
So, we think patch vault agent is more easier.

PS. In my option, Spring Vault 1.x is too old, nobody will patch it.

[aantono]

Looking at Spring Vault codebase, it would be a very difficult patch given that the internal notion of VaultToken is being carried all throughout the code, so adding a multitude of checks for if vaultToken == null would be a bit rough. ;)
It also does not help with any other frameworks which might, or might not, also have the same expectation of always expecting a vault token to be present.

Looking at the vault agent codebase it "appears" that the fix could be relatively simple.

1. Add another property - use_auto_auth_token_enforce to https://github.com/hashicorp/vault/blob/master/command/agent/config/config.go#L45
2. Pass the config value when creating cache.Handler in https://github.com/hashicorp/vault/blob/master/command/agent.go#L459
3. If the use_auto_auth_token_enforce is set to true, ignore setting the token from client request header in https://github.com/hashicorp/vault/blob/master/command/agent/cache/handler.go#L27

[catsby]

I merged https://github.com/hashicorp/vault/pull/8101 , and will follow up with a separate pull request the corresponding documentation