docs(mesh): in Vault docs switch to orphan tokens (#6964)

* docs(mesh): in Vault docs switch to orphan tokens * Update app/_src/mesh/features/vault.md Co-authored-by: Diana <[email protected]> * Update app/_src/mesh/features/vault.md Co-authored-by: Diana <[email protected]> * docs: tweak orphan token explanation --------- Co-authored-by: Diana <[email protected]>
Kong · Feb 23, 2024 · b6fda97 · b6fda97
1 parent 65c411c
commit b6fda97
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/app/_src/mesh/features/vault.md b/app/_src/mesh/features/vault.md
@@ -169,12 +169,14 @@ vault policy write kmesh-default-dataplane-proxies kmesh-default-dataplane-proxi
 
 #### Step 4. Configure authentication method:
 
-To authorize {{site.mesh_product_name}} to vault using a token, generate the token and pass it to mesh:
+To authorize {{site.mesh_product_name}} to vault using a token, generate the following orphan token and pass it to the mesh:
 
 ```sh
-vault token create -format=json -policy="kmesh-default-dataplane-proxies" | jq -r ".auth.client_token"
+vault token create -type=service -orphan -format=json -policy="kmesh-default-dataplane-proxies" | jq -r ".auth.client_token"
 ```
 
+We suggest using an [orphan token to avoid surprising behavior around expiration in token hierarchies](https://developer.hashicorp.com/vault/docs/concepts/tokens#token-hierarchies-and-orphan-tokens).
+You need root/sudo permissions to execute the previous command.
 The output should print a Vault token that you then provide as the `conf.fromCp.auth.token` value of the `Mesh` object.
 
 {:.note}