hashicorp / hashicorp/consul-template

Secret function doesn't honour at-sign (@) to load file contents into an attribute

Open
#1,489 0 comments 0 reactions 0 assignees View on GitHub
enhancement hashicat-update-required vault
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

### Consul Template version

compiled from main @ commit 51401f314b34a4a44f8e82a2320e609d6da5553a

### Configuration

```hcl
vault {
address = "http://127.0.0.1:8200"
}

template {
source = "./in.tmpl"
destination = "./out.cer"
}

```

```liquid
{{ with secret "pki_int/sign/example-dot-com" "ttl=60s" "csr=@./MYCSR.csr" }}
{{ .Data.certificate }}
{{ end }}
```
### Command

```shell
consul-template -template "in.tmpl:out.cer"
or
consul-template -config config.hcl
```

### Expected behavior

The Vault convention of prefixing a file with an @ then causes the contents to be read and used as the value

### Actual behavior

The string is used literally, passing the value '@./MYCSR.csr' to Vault, causing an HTTP 400

### Steps to reproduce

1. Create a template and CSR as above
2. Configure Vault using https://learn.hashicorp.com/tutorials/vault/pki-engine?in=vault/secrets-management
2. Execute consul-template against Vault

Contributor guide

Open the contributing guide

Research direction

Start with the `secret` template function used in `in.tmpl` and trace how its arguments are passed to the Vault request. Reproduce with `csr="@./MYCSR.csr"` and the provided `consul-template` command; done means the file contents are sent instead of the literal `@./MYCSR.csr` value.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.