hashicorp / hashicorp/consul-template

Enhancement: control Vault path if doesn't exists

Open
#1,377 4 comments 6 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

### Consul Template version

consul-template v0.25.0 (99efa642)

### Configuration

Config: `test.conf`
```hcl
consul {
address = "http://consul.internal"
ssl {
enabled = false
}
}
vault {
address = "https://vault.internal"
}
template {
source = "test.ctmpl"
destination = "test.txt"
error_on_missing_key = true
left_delimiter = "[{"
right_delimiter = "}]"
}

```
Template: `test.ctmpl`
```liquid
[{ range ls "webservice/frontend/env_vars" -}]
[{ scratch.MapSet "vars" .Key .Value -}]
[{ end -}]

[{ with secret "kv/webservice/frontend/env_vars" -}]
[{ range $k, $v := .Data.data -}]
[{ scratch.MapSet "vars" $k $v -}]
[{ end -}]
[{ end -}]

[{ range $k, $v := scratch.Get "vars" }]
[{ $k }]=[{ $v -}]
[{ end }]
```

### Command

```shell
consul-template -config=test.conf -once -dry
```

### Expected behavior
This is not a bug, I'm asking for an improvement.

Given the previous template, when asking consul, if the CONSUL PATH doesn't exist the execution continues. Also I can add a `keyExists` and control the output.

But, if the VAULT PATH doesn't exists I got the error described in this issue and the execution stalls.
I would like to have the same behaviour as Consul with `keyExists` or something similar, to control it.

Why?
Sometimes we don't need vars from VAULT, only from CONSUL.
We create custom AMIs with Packer and we use this template for all instances. So it depends on the instance we spawn it might need values from Vault or not.
So basically the behaviour we would like to have is:
```shell
if vaultKeyExists
key_from_vault
else
foo=bar
end
```

In short, have the same control in vault that we have in consul when a path doesn't exists.

### Actual behavior

```shell
2020/04/29 15:01:28.126705 [WARN] (view) vault.read(kv/webservice/frontend/env_vars): no secret exists at kv/data/webservice/frontend/env_vars (retry attempt 3 after "1s")
``

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named in the issue. Start by locating Vault path handling and comparing it with the existing Consul missing-path behavior; confirm how template conditionals or a key-existence helper are exposed. Done means a missing Vault path can be handled without stalling while existing Vault lookups retain their behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.