Vault in dev mode clobbers the .vault-token file

[ekristen]

I noticed something today while working with a local vault dev instance for testing, it seems that even though I am running the following command:

VAULT_ADDR=http://localhost:8200 VAULT_TOKEN="UUID" vault write secret/test value="testing"

The CLI then writes the token to the ~/.vault-token file overwriting my primary token that I use for my production vault setup.

It seems to me that if the ENV var is present ~/.vault-token should not be read from or written to.

What do you think @jefferai

[jefferai]

Non-reproducible for me (and as a side note, I use this workflow all the time and have never seen this):

$ cat .vault-token
root

$ vault token-create 
Key             Value
---             -----
token           a26a9e5e-2acf-3ddb-9f32-9b0590d25186
token_accessor  d22f1523-3eea-d75d-2b4e-7acfa44fdc54
token_duration  0s
token_renewable false
token_policies  [root]

$ VAULT_TOKEN=a26a9e5e-2acf-3ddb-9f32-9b0590d25186 vault write secret/test value="testing"
Success! Data written to: secret/test

$ cat .vault-token
root

[ekristen]

My mistake @jefferai, you are right, it happens slightly different, I didn't notice until now because I didn't think it cat the .vault-token after every step before.

It seems that the .vault-token file is overwritten automatically regardless if the file exists or not when you run vault server -dev.

Personally, I find this behavior undesirable, but looking at the docs, I suppose the "Automatically Authenticated" covers this behavior although it doesn't clearly state that is what it is doing.

[vishalnayak]

Not reproducible and vault server -dev caching the token at ~/.vault-token is an expected behavior. Closing the issue. Reopen if needed.

[stevenschlansker]

I just ran into this problem as well -- every time I run my unit tests, I am logged out of Vault CLI.
I can understand why this is a nice first user experience, for vault server -dev to write ~/.vault-token, but if you use -dev for any other purpose (say, unit or integration tests) it quickly ruins your development workflow.

Perhaps there could be additionally a -no-store-token option for unit test runners?

[jefferai]

PRs welcome. I'd match the flags from vault login.