hashicorp / hashicorp/consul-template
Consul-template doesn't to re-read value from Vault
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
### Consul Template version
consul-template v0.29.6 (e4f5d58)
### Configuration
```hcl
vault {
address = "https://myvault"
token = "mytoken"
renew_token = true
lease_renewal_threshold = 0.0001
}
pid_file = "/run/consul-template.pid"
log_level = "INFO"
syslog {
enabled = true
facility = "LOCAL5"
}
template {
command = "sudo /opt/consul-template/scripts/myscript.sh "
destination = "/opt/consul-template/scripts/myscript.sh"
perms = "755"
source = "/opt/consul-template/templates/myscript.sh.tpl"
}
```
```liquid
{{ range secrets "main/env/users" }}
{{ with secret (printf "main/env/users/%s" .) }}
echo "For {{ .Data.name }} now value1 this is {{ .Data.value1 }}"
{{ end }}{{ end }}
{{ with secret "main/env/users/user1" }}
echo "---direct ----- for {{ .Data.name }} now value this is {{ .Data.value }}"
{{ end }}
{{ with secret "main/env/users/user2" }}
echo "---direct ----- for {{ .Data.name }} now value this is {{ .Data.value }}"
{{ end }}
```
in Vault storage (kv1 Secret engine) created 2 secrets: main/env/users/user1 and main/env/users/user1
with same keys and different values : name={user1,users2} and value={value1, value2} accordingly.
### Expected behavior
1 ) Consul-template should read data from secretes.
2) After changed value in Vaul -> Consul-template should update the value in template.
### Actual behavior
1) Consul-template has read data from secrets and rendered correctly:
echo "For user1 now value1 this is value1 "
echo "For user2 now value1 this is value2 "
2) After changing the value in Vault Consul-template uses/renders old value
### Steps to reproduce
1. Create secret in Vault and use it in Consul-template
2. Change only value in Vault
3. Check logs or rendered template
Contributor guide
Research direction
Start with the supplied Consul Template configuration and reproduce the issue against Vault's KV v1 engine by changing only a stored value, then inspect the refresh behavior and logs. Done means a subsequent render reflects changed values for both the direct and ranged secret lookups.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100