hashicorp / hashicorp/consul-template

Log the source of the vault token to help in diagnosing renewal behavior

Open
#1,408 5 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

The Vault token can be read from one of 3 different sources. Some of these are set in a backward compatible way that hides the source and makes determining the token's source difficult. Adding a log entry for these could go a long way in helping here.

As a reminder the 3 ways are:
- config file
- token file (defaults to `~/.vault-token` for backward compatibility)
- environment variable `VAULT_RENEW_TOKEN`

### Consul Template version

consul-template v0.25.1 (b11fa800)

### Configuration

None supplied, using flags and defaults.

### Command

```shell
consul-template -exec 'bash -c "while true; do echo $(date); sleep 300; done"'
```

### Debug output

https://gist.github.com/angrycub/d5f9693bb3fcb5fc5b6f4e01355bb001

### Expected behavior

As no Vault token was provided by any means, I would not expect a Vault token renewer to start since it would be impossible to renew. In the absence of a configured token (via environment or config), I would expect the behavior provided by setting `-vault-renew-token=false`

### Actual behavior

A renew starts and attempts to use the default Vault address of https://127.0.0.1:8200 resulting in
```
2020/08/26 19:14:42.213972 [WARN] vault.token: failed to renew: Put https://127.0.0.1:8200/v1/auth/token/renew-self: dial tcp 127.0.0.1:8200: connect: connection refused
```
this will retry until max attempts and then terminate the consul-template process and the child process.

### Steps to reproduce

1. Run consul template with the following command, providing no other configuration:

```
consul-template --log-level=trace -exec 'bash -c "while true; do echo $(date); sleep 300; done"'
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the provided consul-template command and trace logging, then follow the Vault token loading and renewal path. Done means logs identify whether the token came from the config file, token file, or VAULT_RENEW_TOKEN, and the no-token case behaves as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, observability
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.