hashicorp / hashicorp/consul-template

Consul-template doesn't to re-read value from Vault

Open
#1,689 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

### Consul Template version

consul-template v0.29.6 (e4f5d58)

### Configuration

```hcl
vault {
address = "https://myvault"
token = "mytoken"
renew_token = true
lease_renewal_threshold = 0.0001

}

pid_file = "/run/consul-template.pid"
log_level = "INFO"
syslog {
enabled = true
facility = "LOCAL5"
}
template {
command = "sudo /opt/consul-template/scripts/myscript.sh "
destination = "/opt/consul-template/scripts/myscript.sh"
perms = "755"
source = "/opt/consul-template/templates/myscript.sh.tpl"
}

```

```liquid
{{ range secrets "main/env/users" }}
{{ with secret (printf "main/env/users/%s" .) }}
echo "For {{ .Data.name }} now value1 this is {{ .Data.value1 }}"
{{ end }}{{ end }}

{{ with secret "main/env/users/user1" }}
echo "---direct ----- for {{ .Data.name }} now value this is {{ .Data.value }}"
{{ end }}

{{ with secret "main/env/users/user2" }}
echo "---direct ----- for {{ .Data.name }} now value this is {{ .Data.value }}"
{{ end }}

```

in Vault storage (kv1 Secret engine) created 2 secrets: main/env/users/user1 and main/env/users/user1
with same keys and different values : name={user1,users2} and value={value1, value2} accordingly.

### Expected behavior

1 ) Consul-template should read data from secretes.
2) After changed value in Vaul -> Consul-template should update the value in template.

### Actual behavior

1) Consul-template has read data from secrets and rendered correctly:
echo "For user1 now value1 this is value1 "
echo "For user2 now value1 this is value2 "
2) After changing the value in Vault Consul-template uses/renders old value

### Steps to reproduce

1. Create secret in Vault and use it in Consul-template
2. Change only value in Vault
3. Check logs or rendered template

Contributor guide

Open the contributing guide

Research direction

Start with the supplied Consul Template configuration and reproduce the issue against Vault's KV v1 engine by changing only a stored value, then inspect the refresh behavior and logs. Done means a subsequent render reflects changed values for both the direct and ranged secret lookups.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.