hashicorp / hashicorp/consul-template

Vualt token renew doesn't retry on failure

Open
#2,058 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
4.8k
Forks
801
Avg merge
4h 5m
Merged PRs (30d)
6

Description

If consul-template is configured to use vault token with a renew configuration, and the vault token renew fails once (for example the server is temporarily unreachable), it doesn't retry like intended.

> 2025-05-08T11:37:57.417Z [WARN] vault.token: failed to renew: context deadline exceeded
2025-05-08T11:37:57.417Z [WARN] vault.token: renewer done (maybe the lease expired)

After that it hangs.

Problem comes from the line:
https://github.com/hashicorp/consul-template/blob/1adb94d61529f621c83ab7a8bed01e8764ac2087/watch/view.go#L165

The channel that is being written isn't buffered and there is no one reading from that channel for the special vault token watcher:
https://github.com/hashicorp/consul-template/blob/1adb94d61529f621c83ab7a8bed01e8764ac2087/manager/runner.go#L85

Contributor guide

Open the contributing guide

Research direction

Start by tracing the watcher interaction at view.go:165 and manager/runner.go:85, focusing on the special Vault token watcher and what happens after renewal fails. Done means a temporary Vault renewal failure does not leave the process hanging and the token renewal retries as intended.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.