We use Vault Agent as a sidecar that writes a fresh MongoDB connection string to a file every 12 hours. Our Node/Express app uses a file watcher to monitor that file and, on change, swaps to a new MongoClient and closes the old one.
Is this file-watching pattern what people actually use in production? Or is there a better way to handle rotation without pulling a Vault SDK into the app?
We are trying to keep Vault-specific logic out of our application and rely on the sidecar for credential delivery. Curious if this is the standard pattern or if there’s something more robust we should be doing.
That is a perfectly valid workflow. If its working well for you and your app thats great. Only heads up I would call out (and apologies if youre already doing this) is to make sure the file permissions are locked down so its not accessible by other processes.
Another consideration if something about your current workflow makes you uncomfortable is to consider environment variables from Vault Agent. You can see an example pattern here:
Thanks for the confirmation and the heads-up. I’ll definitely look into tightening the file permissions. I’ll also take a look at the environment variable approach, although the file-watching pattern has been working well for us so far.