agent-policy.hcl

path "auth/approle/role/agent/role-id" {
  capabilities=["read"]
}

path "auth/approle/role/agent/secret-id" {
  capabilities=["read","update"]
}

path "kv/data/application/db01" {
  capabilities=["read"]
}

db_pass.ctmpl

{{ with secret "kv/data/application/db01" }}
password: {{ .Data.data.password }}
{{ end }}

vault-agent.hcl

vault {
  address = "https://vault:8200"
}

auto_auth {
  method "approle" {
    mount_path = "auth/approle"
    config = {
      role_id_file_path   = "creds/role-id"
      secret_id_file_path = "creds/secret-id"

      # Helpful to accelerate testing vault agent config
      # Default is true
      remove_secret_id_file_after_reading = false
    }
  }

  sink "file" {
    wrap_ttl = "5m"
    config = {
      path = "creds/vault-token"
    }
  }
}

# Get db pass
template {
  source      = "application/db_pass.ctmpl"
  destination = "application/db_pass.txt"
}