Vault Agent自动认证异常：连接代理后认证状态返回False

背景 #

Vault Agent具备Auto-Auth特性，可自动向Vault认证并管理令牌续期。我配置了Vault Agent与Server后，使用hvac连接Agent的代理端口，调用is_authenticated()却返回False，但Agent日志显示认证流程成功。

Vault Agent配置 #

pid_file = "F:/Vault/vault-agent/agent.pid"
log_file = "F:/Vault/vault-agent/trace.log"
vault {address = "http://127.0.0.1:8200"}
auto_auth {
  method "approle" {
    config = {
      role_id_file_path   = "F:/Vault/vault-agent/agent-role-id"
      secret_id_file_path = "F:/Vault/vault-agent/agent-secret-id"
      #remove_secret_id_file_after_reading = false
    }
  }
  sink "file" {
    config = {
      path = "F:/Vault/vault-agent/agent-token"
    }
  }
}
cache {
  use_auto_auth_token = true
}
listener "tcp" {
  address     = "127.0.0.1:8100"
  tls_disable = true
}

Vault Server配置 #

disable_mlock = true
api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"
ui = true
pid_file = "F:/Vault/data/vault.pid"
log_file = "F:/Vault/data/trace.log"
storage "raft" {
  path    = "F:/Vault/data"
  node_id = "raft_node_id"
}
listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = "true"
}

执行代码 #

import hvac
client = hvac.Client(url='http://localhost:8100')
client.is_authenticated()

预期与实际结果 #

• 预期结果：True
• 实际结果：False

Vault Agent日志 #

2024-03-05T04:35:06.403+0200 [INFO]  agent.sink.server: starting sink server
2024-03-05T04:35:06.403+0200 [INFO]  agent.auth.handler: authenticating
2024-03-05T04:35:06.922+0200 [INFO]  agent.auth.handler: authentication successful, sending token to sinks
2024-03-05T04:35:06.924+0200 [INFO]  agent.sink.file: token written: path=F:/Vault/vault-agent/agent-token
2024-03-05T04:35:06.932+0200 [INFO]  agent.auth.handler: starting renewal process
2024-03-05T04:35:07.245+0200 [INFO]  agent.auth.handler: renewed auth token
2024-03-05T04:37:53.816+0200 [INFO]  agent.apiproxy: received request: method=GET path=/v1/auth/token/lookup-self
2024-03-05T04:37:53.817+0200 [INFO]  agent.apiproxy: forwarding request to Vault: method=GET path=/v1/auth/token/lookup-self
2024-03-05T05:17:18.781+0200 [INFO]  agent.auth.handler: renewed auth token

原因分析与解决方法 #

原因 #

hvac的is_authenticated()方法会发送/v1/auth/token/lookup-self请求验证令牌有效性，但当前Agent配置下，不会自动为未携带令牌的请求注入Auto-Auth获取的令牌。日志显示Agent转发了该请求，但由于请求无令牌，Vault返回未认证，导致方法返回False。

解决方法 #

方法1：启用Agent自动令牌注入

修改Vault Agent的listener配置，添加inject_token = true，让Agent自动为所有无令牌的请求注入Auto-Auth令牌：

listener "tcp" {
  address     = "127.0.0.1:8100"
  tls_disable = true
  inject_token = true  # 新增配置
}

重启Agent后，重新执行hvac代码即可得到预期的True结果。

方法2：手动读取令牌传入hvac客户端

直接读取Agent写入agent-token文件的令牌，手动传入hvac客户端：

import hvac

# 读取Agent生成的令牌文件
with open("F:/Vault/vault-agent/agent-token", "r") as f:
    token = f.read().strip()

client = hvac.Client(url='http://localhost:8100', token=token)
print(client.is_authenticated())  # 返回True

内容的提问来源于stack exchange，提问作者Ibrahim Saber