Task 9.1: Describe the Vault Agent

• ASyncing Vault secrets into Kubernetes Secret objects

  Incorrect

  Writing Kubernetes Secrets is what the Vault Secrets Operator does.

• BAuto-auth, which logs in and keeps the resulting token renewed

  Correct

  Auto-auth authenticates to Vault and manages token renewal.

• CTemplates that render secrets into files for an application

  Correct

  Agent renders user-supplied templates using the auto-auth token.

• DUnsealing Vault server nodes when they start

  Incorrect

  Unsealing is done by the server's seal, either Shamir shares or auto unseal.

• EServing as the recommended proxy for Vault's API

  Incorrect

  Agent's API proxy is deprecated, so Agent is not the recommended proxy.

Vault Agent is a client daemon: auto-auth, templating, caching and process supervisor mode bring secrets to applications that do not call Vault themselves.

• AVault Proxy with auto-auth and caching, with the application pointed at the proxy's listener address

  Incorrect

  Vault Proxy renders no files, and the application cannot call an API.

• BThe Vault Secrets Operator syncing the credentials to a secret

  Incorrect

  The operator syncs into Kubernetes Secrets; it does not run on a plain virtual machine.

• CVault Agent with a template for the file and exit_after_auth set to true

  Incorrect

  With exit_after_auth the agent stops after the first render, so nothing renews or rewrites the file.

• DVault Agent with auto-auth and a template that renders the credentials into the file

  Correct

  Agent logs in, renews its token and leases, and re-renders templates, so the application keeps reading a file.

Templates plus auto-auth are the standard path for applications that read files; the agent keeps the token and leases alive behind them.

• AA file sink for the password, which Agent exports as a variable

  Incorrect

  Sinks write tokens to files; they do not set environment variables.

• BAgent's caching listener, which the app queries for its variables

  Incorrect

  Caching serves API responses; it does not set a process's environment.

• CProcess supervisor mode: env_template blocks and an exec block for the app

  Correct

  Agent injects env_template secrets as environment variables into the child process named in exec.

• DA template stanza with exit_after_auth, which exports the result

  Incorrect

  File templates render files; exit_after_auth stops Agent after the first render.

Process supervisor mode needs at least one env_template block and exactly one exec block, and can restart the child when secrets change.

• AA template that renders the token from a KV secret

  Incorrect

  The token comes from auto-auth, not from a stored secret.

• BAn auto-auth file sink, which writes the token whenever it changes

  Correct

  A sink is where Agent saves the token each time the token value changes.

• CAgent's API proxy, which writes tokens for every request

  Incorrect

  The proxy forwards requests; sinks write tokens to files.

• DProcess supervisor mode, which saves the token as a file

  Incorrect

  Supervisor mode passes secrets as environment variables.

Tools that only read a token file then always find a current token without logging in themselves.

• AThe SecretID expired, and Vault removed the file from the host

  Incorrect

  Vault cannot touch files on a client host; the agent removed it.

• BA template rendered over the SecretID file with its first secret

  Incorrect

  Templates write to their own destination paths.

• CThe agent moved the SecretID into a cubbyhole for safekeeping

  Incorrect

  Auto-auth caches the values in the agent; it does not store them in Vault.

• DBy default the agent deletes the SecretID file after reading it

  Correct

  remove_secret_id_file_after_reading defaults to true; the agent caches the value and reads any new file at the next authentication.

Set remove_secret_id_file_after_reading to false to keep the file; new files written at the same path are picked up at the next authentication.

• Avault.hashicorp.com/agent-pre-populate-only: "true"

  Correct

  With it, only the init container is injected, which is recommended for Job and CronJob workloads.

• Bvault.hashicorp.com/agent-pre-populate: "false"

  Incorrect

  That removes the init container and keeps the sidecar.

• Cvault.hashicorp.com/agent-inject: "false"

  Incorrect

  That disables injection and the job gets no secrets.

• Dvault.hashicorp.com/agent-inject-command: "exit 0"

  Incorrect

  A command after rendering does not remove the sidecar.

The injector adds an init container that pre-populates secrets and a sidecar that keeps them current; jobs need only the first.