Vault agent persistent caching

Vault Agent can restore tokens and leases from a persistent cache file created by a previous Vault Agent process. The persistent cache is a BoltDB file that includes tuples encrypted by a generated encryption key. The encrypted tuples include the Vault token used to retrieve secrets, leases for tokens/secrets, and secret values.

In order to use Vault Agent persistent cache, auto-auth must be used. If the auto-auth token has expired by the time the cache is restored, the cache will be invalidated and secrets will need to be re-fetched from Vault.

If Vault Agent templating is enabled alongside of the persistent cache, Vault Agent will automatically route templating requests through the cache. This ensures template requests are cached and restored properly.

Vault agent persistent cache types

Please see the sidebar for available types and their usage/configuration.

Persistent cache example configuration

Here is an example of a persistent cache configuration.

# Other Vault agent configuration blocks
# ...

cache {
  use_auto_auth_token = true
  persist "kubernetes" {
    path = "/vault/agent-cache"
  }
}