hashicorp / hashicorp/envconsul

Intermittent issue with format="GOOGLE_APPLICATION_CREDENTIALS{{ .data.private_key_data }}"

Open
#225 2 comments 0 reactions 0 assignees View on GitHub
bug unreproducible waiting-reply
Dominant language
Go
Stars
2.1k
Forks
194
PR merge metrics
No merged PRs in 30d

Description

When I use `format=` in the `secret` stanza for Variable interpolation, sometimes EnvConsul sets the incorrect value. This problem is fairly easy to reproduce.

In this case, I am reading a dynamic GCP service account key from Vault. Vault returns 3 fields in data (full key is truncated as ):
```
vault read -format=json gcp/key/$role
{
"request_id": "5e493ddb-b794-5bf0-9a44-14bdceb1dcdc",
"lease_id": "gcp/key/viewer/1XXN6zn7CizhXluJPGthrH1v",
"lease_duration": 50,
"renewable": true,
"data": {
"key_algorithm": "KEY_ALG_RSA_2048",
"key_type": "TYPE_GOOGLE_CREDENTIALS_FILE",
"private_key_data": "ewo"
},
"warnings": null
}
```
The application expects GOOGLE_APPLICATION_CREDENTIALS to contain the value of `private_key_data`. This can be achieved by specifying: `format="GOOGLE_APPLICATION_CREDENTIALS{{ .data.private_key_data }}"`
However, sometimes it gets set as `KEY_ALG_RSA_2048` or `TYPE_GOOGLE_CREDENTIALS_FILE`.

### Envconsul version
```
envconsul v0.9.1 (b5e928a7)
```

### Configuration
testgcp1.hcl file
```hcl
sanitize=true
upcase=true
log_level="debug"
pid_file="/tmp/envconsul.pid"

vault {
# Using VAULT_ADDR
renew_token = false

ssl {
enabled = false
verify = false
}
}
exec {
command = "/Users/kawsark/code/local/envconsul/app-wrapper.sh"
splay = "5s"
}

secret {
format="GOOGLE_APPLICATION_CREDENTIALS{{ .data.private_key_data }}"
no_prefix = false
path = "gcp/key/viewer"
}
```

### Command
```shell
envconsul -config testgcp1.hcl
```

### Debug output
Provide a link to a GitHub Gist containing the complete debug output by running
with `-log-level=debug`.
Please see: [https://gist.github.com/kawsark/f659cf6644cbac94527ae7f062dbdb63](https://gist.github.com/kawsark/f659cf6644cbac94527ae7f062dbdb63)

### Expected behavior
`GOOGLE_APPLICATION_CREDENTIALS` environment variable should be populated with Base64 encoded Google service account. In the Gist below, when it works, GOOGLE_APPLICATION_CREDENTIALS is shown as below (full key is truncated as ):
[https://gist.github.com/kawsark/f659cf6644cbac94527ae7f062dbdb63](https://gist.github.com/kawsark/f659cf6644cbac94527ae7f062dbdb63)
```shell
Loop # 0
Checking for GOOGLE_APPLICATION_CREDENTIALS
ewo=
```

### Actual behavior
Although it works most of the time, sometimes `GOOGLE_APPLICATION_CREDENTIALS` environment variable contain a value of `KEY_ALG_RSA_2048` or `TYPE_GOOGLE_CREDENTIALS_FILE`. In the Gist below, when it does not work, GOOGLE_APPLICATION_CREDENTIALS is set to KEY_ALG_RSA_2048 on line 102
[https://gist.github.com/kawsark/f659cf6644cbac94527ae7f062dbdb63#file-envconsul-txt-L100](https://gist.github.com/kawsark/f659cf6644cbac94527ae7f062dbdb63#file-envconsul-txt-L100)
```shell
Loop # 0
Checking for GOOGLE_APPLICATION_CREDENTIALS
KEY_ALG_RSA_2048
```

### Steps to reproduce
1. Using a root or admin token, setup a GCP secrets engine as below:
```
vault login
export GOOGLE_CLOUD_PROJECT=""
export role="viewer"

vault secrets enable gcp
vault secrets tune -default-lease-ttl=50s -max-lease-ttl=60s gcp
vault write gcp/config credentials=@gcp-root-service-account.json
vault write gcp/roleset/$role project="${GOOGLE_CLOUD_PROJECT}" secret_type="service_account_key" bindings=-< envconsul.policy
path "gcp/key/$role" {
capabilities = ["read"]
}
EOF

vault policy write envconsul envconsul.policy
vault token create -policy=envconsul -ttl=24h
export VAULT_TOKEN=
# Or:
# export VAULT_TOKEN=$(vault token create -ttl=24h -policy=envconsul | grep 'token.*s\.' | awk '{print $NF}')
```

3. Download example application and invoke EnvConsul
Example application script provided here: [https://gist.github.com/kawsark/74a87420dd9a3a1d9a0c7d4276d30aa9](https://gist.github.com/kawsark/74a87420dd9a3a1d9a0c7d4276d30aa9)
```
wget https://gist.githubusercontent.com/kawsark/74a87420dd9a3a1d9a0c7d4276d30aa9/raw/9b72a1242aa36f3743a883c632d686e0666208c7/app-wrapper.sh
chmod +x app-wrapper.sh
envconsul -config testgcp1.hcl
```

### References
Are there any other GitHub issues (open or closed) that should be linked here?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.