hashicorp / hashicorp/consul-template
Vualt token renew doesn't retry on failure
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 801
- Avg merge
- 4h 5m
- Merged PRs (30d)
- 6
Description
If consul-template is configured to use vault token with a renew configuration, and the vault token renew fails once (for example the server is temporarily unreachable), it doesn't retry like intended.
> 2025-05-08T11:37:57.417Z [WARN] vault.token: failed to renew: context deadline exceeded
2025-05-08T11:37:57.417Z [WARN] vault.token: renewer done (maybe the lease expired)
After that it hangs.
Problem comes from the line:
https://github.com/hashicorp/consul-template/blob/1adb94d61529f621c83ab7a8bed01e8764ac2087/watch/view.go#L165
The channel that is being written isn't buffered and there is no one reading from that channel for the special vault token watcher:
https://github.com/hashicorp/consul-template/blob/1adb94d61529f621c83ab7a8bed01e8764ac2087/manager/runner.go#L85
Contributor guide
Research direction
Start by tracing the watcher interaction at view.go:165 and manager/runner.go:85, focusing on the special Vault token watcher and what happens after renewal fails. Done means a temporary Vault renewal failure does not leave the process hanging and the token renewal retries as intended.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100