Our usecase is a jenkins runner that is scheduled to run 1/year, and make a specific vault write command (pki sign of CSR). It needs a “long-running” secret with a ttl=0 to do this, and cannot use a token but must use a secret_ID with approle or userpass auth method.

The idea is it have a secretid+role id availible (like username+pass) on the runner for this operation:

But!

The best practices recommends wrapping the secret_id and having an initial token. What makes this more secure and what specific attacks makes the extra config worth it. Wouldnt a permanent token/secret with ttl=0 still be neede to be kept somewhere?

Resources:
https://www.hashicorp.com/blog/how-and-why-to-use-approle-correctly-in-hashicorp-vault
https://www.hashicorp.com/resources/vault-response-wrapping-makes-the-secret-zero-challenge-a-piece-of-cake