Why can't I self renew in vault? Never mind. the feature doesn't exist in 0.3.1, time to upgrade.

0-command

curl --tlsv1.2 -v -d @asdf.json -X POST -H "X-Vault-Token: $VAULT_TOKEN" https://127.0.0.1:8200/v1/sys/auth/token/renew-self

asdf.json

{
  "auth": {
    "client_token": "SAME_AS_IN_VAULT_TOKEN",
    "policies": ["pg_devops_secret_ro"],
    "lease_duration": 2592000,
    "renewable": true
  }
}

policy

path "sys/*" {
  policy = "deny"
}

path "secret/ops/configs/properties/product_groups/*" {
  policy = "read"
}

path "auth/token/lookup-self" {
  policy = "read"
}

path "auth/token/renew-self" {
  policy = "write"
}

results

< HTTP/1.1 403 Forbidden
< Content-Type: application/json
< Date: Tue, 22 Dec 2015 18:59:55 GMT
< Content-Length: 33
< 
{"errors":["permission denied"]}