Issuer/ClusterIssuer support to specify vault token on local filesystem

[andrejvanderzee]

The documentation https://cert-manager.io/v0.16-docs/configuration/vault/ sais:

cert-manager does not refresh these token automatically and so another process must be put in place to do this.

Can I suggest an option auth.vaultTokenPath on local filesystem as an alternative for auth.tokenSecretRef? Then we can use a Vault sidecar that takes care of token refreshes in a shared volume mount with the cert-manager container. https://www.vaultproject.io/docs/platform/k8s/injector

[andrejvanderzee]

Anybody? This looks like a flawed implementation ending up with an orphaned vault token with high TTL or some custom side-car implementation that updated the Kubernetes secret with refreshed Vault token and restarts cert-manager.

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[jetstack-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[jetstack-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

[jetstack-bot]

@jetstack-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.