hashicorp / hashicorp/consul-template
Secret function doesn't honour at-sign (@) to load file contents into an attribute
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
### Consul Template version
compiled from main @ commit 51401f314b34a4a44f8e82a2320e609d6da5553a
### Configuration
```hcl
vault {
address = "http://127.0.0.1:8200"
}
template {
source = "./in.tmpl"
destination = "./out.cer"
}
```
```liquid
{{ with secret "pki_int/sign/example-dot-com" "ttl=60s" "csr=@./MYCSR.csr" }}
{{ .Data.certificate }}
{{ end }}
```
### Command
```shell
consul-template -template "in.tmpl:out.cer"
or
consul-template -config config.hcl
```
### Expected behavior
The Vault convention of prefixing a file with an @ then causes the contents to be read and used as the value
### Actual behavior
The string is used literally, passing the value '@./MYCSR.csr' to Vault, causing an HTTP 400
### Steps to reproduce
1. Create a template and CSR as above
2. Configure Vault using https://learn.hashicorp.com/tutorials/vault/pki-engine?in=vault/secrets-management
2. Execute consul-template against Vault
Contributor guide
Research direction
Start with the `secret` template function used in `in.tmpl` and trace how its arguments are passed to the Vault request. Reproduce with `csr="@./MYCSR.csr"` and the provided `consul-template` command; done means the file contents are sent instead of the literal `@./MYCSR.csr` value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100