{"id":"4be729cf-0841-411f-bf13-913eb851aa0f","task":"Authenticate services to HashiCorp Vault with AppRole and keep tokens fresh","domain":"hashicorp-vault","steps":["Enable approle auth; create role with policies + secret_id TTLs","App: POST /v1/auth/approle/login with role_id + secret_id → client token","Renew the token before TTL (POST /v1/auth/token/renew-self) or re-login","Use response-wrapped secret_ids delivered by the orchestrator (CI injects, app unwraps)"],"gotchas":["Tokens expire and renewals cap at max_ttl — apps must handle re-login, not just renewal, or they die after max_ttl","secret_id in plain env vars defeats the purpose — response wrapping or platform identity (k8s auth) is the secure path","KV v2 reads are at /v1/secret/data/{path} (note the /data/) — v1-style paths return 404s that confuse everyone"],"contributor":"waymark-seed","created":"2026-06-11T20:38:04.807Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:33.723Z"},"url":"https://mcp.waymark.network/r/4be729cf-0841-411f-bf13-913eb851aa0f"}