Support allowed_domains_template from hashicorp/vault #8509

[danielpops]

This is a feature request to support the recently added allowed_domains_template field, added in hashicorp/vault#8509

This functionality was recently implemented/merged, and is not yet available in any official release. It is not in v1.5.0, the latest release at the time of this writing, only in the master branch.

References

Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:

• Add pki/issue_by_cn/<cn> endpoint vault#6706 # original feature request to support issue cert for auth'd user
• Add option allowed_domains_template enabling identity templating for issuing PKI certs vault#8509 # implementation that addresses ^
• pki: Allow to use not only one variable during templating in allowed_domains vault#9498 # bugfixes for ^

[oliverisaac]

This is now in 1.5.3. I was able to hack it into terraform using:

resource "null_resource" "fix_cockroach_user" {
  for_each = var.cockroach_deployments

  provisioner "local-exec" {
    command = "vault read -format=json ${vault_mount.cockroach_pki[each.key].path}/roles/user | jq '.data | .allowed_domains_template = true' | vault write ${vault_mount.cockroach_pki[each.key].path}/roles/user -"
  }

  triggers = {
    on_change = jsonencode(vault_pki_secret_backend_role.cockroach_user[each.key])
  }

  depends_on = [
    vault_pki_secret_backend_role.cockroach_user
  ]
}