enable transit secret engine at another path

[developer-guy]

Signed-off-by: Batuhan Apaydın batuhan.apaydin@trendyol.com

I have a problem with storing keys in the Vault transit engine. cosign waits for me to enable Vault Transit Secret Engine at path transit/, but in Vault, I don’t have to enable secret engines at its default paths, so, I can override this behavior by using -path option while enabling it. So, in the scenario I have been enabled Transit Secret Engine at a different path, cosign throws an error like the following:

if you want to reproduce that error above, you can type the following commands:

$ vault server -dev -dev-root-token-id root
$ export VAULT_ADDR="http://localhost:8200"
$ export VAULT_TOKEN="root"
$ vault secrets enable -path=keystore transit
$ cosign generate-key-pair -kms hashivault://test-key

This PR is aiming to solve this problem that I mentioned above.

[developer-guy]

cc: @dlorenc @Dentrax

[dlorenc]

Hmm, maybe one idea - what if we put this in the "vault_addr" env var rather than adding a new one? If there's no "suffix", we can default to "/transit", otherwise we can just use the full value. Does that make sense?

[developer-guy]

Hmm, maybe one idea - what if we put this in the "vault_addr" env var rather than adding a new one? If there's no "suffix", we can default to "/transit", otherwise we can just use the full value. Does that make sense?

Hello @dlorenc, thank you for the idea but the VAULT_ADDR environment variable is kind of a special one for Vault, it is better not to change this in order to keep consistent with Vault environment variables, what do you think?. Btw, this is why I don't put the VAULT_ prefix to my environment variable to show that this is not a special environment variable that Vault needs.

[dlorenc]

Ah! Makes sense :)

[dlorenc]

One last thing - we've been trying to get environment variables out of the "library" and "package" code for the most part - that usually belongs in the "application" code that will eventually call this library. What do you think about leaving the environment variable out of here, and setting it in cosign or the other clients?

[dlorenc]

Nevermind, we discussed this would be too tough to get right.