hashicorp / hashicorp/consul-template
Enhancement: control Vault path if doesn't exists
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
### Consul Template version
consul-template v0.25.0 (99efa642)
### Configuration
Config: `test.conf`
```hcl
consul {
address = "http://consul.internal"
ssl {
enabled = false
}
}
vault {
address = "https://vault.internal"
}
template {
source = "test.ctmpl"
destination = "test.txt"
error_on_missing_key = true
left_delimiter = "[{"
right_delimiter = "}]"
}
```
Template: `test.ctmpl`
```liquid
[{ range ls "webservice/frontend/env_vars" -}]
[{ scratch.MapSet "vars" .Key .Value -}]
[{ end -}]
[{ with secret "kv/webservice/frontend/env_vars" -}]
[{ range $k, $v := .Data.data -}]
[{ scratch.MapSet "vars" $k $v -}]
[{ end -}]
[{ end -}]
[{ range $k, $v := scratch.Get "vars" }]
[{ $k }]=[{ $v -}]
[{ end }]
```
### Command
```shell
consul-template -config=test.conf -once -dry
```
### Expected behavior
This is not a bug, I'm asking for an improvement.
Given the previous template, when asking consul, if the CONSUL PATH doesn't exist the execution continues. Also I can add a `keyExists` and control the output.
But, if the VAULT PATH doesn't exists I got the error described in this issue and the execution stalls.
I would like to have the same behaviour as Consul with `keyExists` or something similar, to control it.
Why?
Sometimes we don't need vars from VAULT, only from CONSUL.
We create custom AMIs with Packer and we use this template for all instances. So it depends on the instance we spawn it might need values from Vault or not.
So basically the behaviour we would like to have is:
```shell
if vaultKeyExists
key_from_vault
else
foo=bar
end
```
In short, have the same control in vault that we have in consul when a path doesn't exists.
### Actual behavior
```shell
2020/04/29 15:01:28.126705 [WARN] (view) vault.read(kv/webservice/frontend/env_vars): no secret exists at kv/data/webservice/frontend/env_vars (retry attempt 3 after "1s")
``
Contributor guide
Research direction
No source files or tests are named in the issue. Start by locating Vault path handling and comparing it with the existing Consul missing-path behavior; confirm how template conditionals or a key-existence helper are exposed. Done means a missing Vault path can be handled without stalling while existing Vault lookups retain their behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100