diff --git a/docs/secret-distribution.md b/docs/secret-distribution.md index 6b6e1d8..264633f 100644 --- a/docs/secret-distribution.md +++ b/docs/secret-distribution.md @@ -1,6 +1,6 @@ - @@ -80,7 +80,7 @@ That redeploy-and-restart sequence isn't just a claim — here's a real one, sta **Shared-secret variant:** not every template is host-scoped — one credential needed by every docker host for its own registry pushes (see [`docs/registry-and-build.md`](registry-and-build.md)) is templated from a single shared path rather than a per-host one. Same mechanics, just a shared source instead of a private one — and it relies on every host's policy already granting read access to that shared path, the same "shared + private" pattern described in [`docs/secrets-and-pki.md`](secrets-and-pki.md)'s access model. This is the real template list entry, repeated per host: ``` -$ grep -A4 "service: automation" vault_agent/defaults/main.yml +$ grep -B1 -A3 "registry-token.ctmpl" vault_agent/defaults/main.yml - service: automation src_path: .../automation-vm/registry-token/registry-token.ctmpl dest_path: /opt/docker/docker_volumes/registry-token/registry-token