[Feature]: Simplify Vault and Cache Path Configuration for OSS CLI

[shanchunyang0919]

Problem Statement

The current OSS CLI requires two specific paths to be correctly configured for executing commands:

• .identity/cache.json (for cache validation)
• vault.json (path must match what’s stored in the VaultConfig Go struct)

This setup can be confusing for users, especially in multi-container environments like Docker-Compose or Kubernetes, where managing shared volumes and ensuring consistent path configurations across containers is challenging.

Proposed Solution

Introduce a more user-friendly configuration mechanism for the OSS CLI to:

1. Automatically detect or validate the required paths (cache.json and vault.json) during runtime.
2. Provide clear error messages or warnings if the paths are misconfigured.
3. Optionally, allow users to specify these paths via environment variables or a centralized configuration file to simplify setup.

Alternatives Considered

No response

Additional Context

No response

Checklist

• I have read the contributing guidelines
• I have verified this does not duplicate an existing feature request

[jadiaconu]

Hello @shanchunyang0919, I was wondering if the Vault support (which we do have now) is more adequate for such a scenario ? What do you think ?
In a K8S environment a shared ReadMany volume is doable but a shared ReadWriteMany is more challenging.

@beryder, @mkedjour, @copasseron

[shanchunyang0919]

Hi @jadiaconu,

Yes, Vault seems more suitable for our use cases. Are there any docs or instructions (or Helm templates) on how OSS Identity integrates with the Vault interface in Kubernetes environments?

Regarding ReadMany vs. ReadWriteMany, I’m not entirely sure, but our k8s use case looks like this:

1. We expose the identity node service endpoint publicly, allowing users to manually (via CLI?) register issuers and create credential files, which is a write operation. The creds will store either in Vault (?) or the filesystem in the pod that runs the node service.
2. Several farm agents running on different pods need to issue badges for themselves. Based on your design, this requires them to read the credentials.

Additionally, we need to clarify the difference between:

• .identity/cache.json (used for cache validation)
• vault.json (path must match what’s stored in the VaultConfig Go struct)

Some commands fail if cache.json is missing, which causes issues where we must explicitly maintain that cache file.