hashicorp / hashicorp/consul-template
Log the source of the vault token to help in diagnosing renewal behavior
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
The Vault token can be read from one of 3 different sources. Some of these are set in a backward compatible way that hides the source and makes determining the token's source difficult. Adding a log entry for these could go a long way in helping here.
As a reminder the 3 ways are:
- config file
- token file (defaults to `~/.vault-token` for backward compatibility)
- environment variable `VAULT_RENEW_TOKEN`
### Consul Template version
consul-template v0.25.1 (b11fa800)
### Configuration
None supplied, using flags and defaults.
### Command
```shell
consul-template -exec 'bash -c "while true; do echo $(date); sleep 300; done"'
```
### Debug output
https://gist.github.com/angrycub/d5f9693bb3fcb5fc5b6f4e01355bb001
### Expected behavior
As no Vault token was provided by any means, I would not expect a Vault token renewer to start since it would be impossible to renew. In the absence of a configured token (via environment or config), I would expect the behavior provided by setting `-vault-renew-token=false`
### Actual behavior
A renew starts and attempts to use the default Vault address of https://127.0.0.1:8200 resulting in
```
2020/08/26 19:14:42.213972 [WARN] vault.token: failed to renew: Put https://127.0.0.1:8200/v1/auth/token/renew-self: dial tcp 127.0.0.1:8200: connect: connection refused
```
this will retry until max attempts and then terminate the consul-template process and the child process.
### Steps to reproduce
1. Run consul template with the following command, providing no other configuration:
```
consul-template --log-level=trace -exec 'bash -c "while true; do echo $(date); sleep 300; done"'
```
Contributor guide
Research direction
Start by reproducing the issue with the provided consul-template command and trace logging, then follow the Vault token loading and renewal path. Done means logs identify whether the token came from the config file, token file, or VAULT_RENEW_TOKEN, and the no-token case behaves as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, observability
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100