hashicorp / hashicorp/consul-template

Chained/nested templates

Open
#1,981 1 comment 1 reaction 0 assignees View on GitHub
enhancement needs-discussion
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

### Use-cases
We are working on a configs/secrets convention in the Nomad+Consul+Vault stack, and we would like to have the following features:
- Hot reload for config (don't store production configs in the repo/image).
- Store secrets separate from config values (in Vault).
- Don't store each config value separately, as there are too many config values.
- Don't put full config into Vault.

### Attempted Solutions

We found that the ideal solution would be a nested template. We'd like to store the config template in Consul K/V, like this:
```
{
"foo": "bar",
"secret" : "{{with secret "secret/data/nomad/nested-template-test-secrets"}}{{.Data.data.secret}}{{end}}"
}
```
Fetch it from Consul and **use as a template again** to resolve Vaulted values, like this:

```hcl
job "nested-template-test" {
datacenters = ["dc"]
group "nested-template-test" {
task "nested-template-test" {
driver = "docker"
config {
image = "alpine"
interactive = true
}

template {
data = <<-EOF
{{key "nested-template-test-config"}}
EOF
destination = "local/from-consul.json.tmpl"
}
template {
source = "local/from-consul.json.tmpl"
destination = "secrets/from-vault.json"
}

}
}
}
```
### Proposal

Unfortunately, this does not work, looks like Nomad checks all template sources before starting to execute templates.

```
template: failed to read template: exit status 1: failed to open source file "/nested-template-test/local/from-consul.json.tmpl": open /nested-template-test/local/from-consul.json.tmpl: no such file or directory
```

Maybe someone have something else to propose, which may suite our needs...

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.