hashicorp / hashicorp/nomad

Vault client certificates aren't reread on reload

Open
#6,052 4 comments 1 reaction 0 assignees View on GitHub
theme/config theme/vault type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

Specifically, the certificate used/referred to in the `vault.cert_file` and `vault.key_file` sections of the nomad config. The other certs are reloaded/reread on SIGHUP, but not that one.

It's what I've observed experimentally but it would take a bit of work to set this up for me to be able to log and demonstrate it. My understanding is that nomad doesn't reload every config value so this isn't something I'd have to demonstrate/prove deeply, but I can if the symptoms sound surprising.

Contributor guide

No contributing guide indexed for this repository

Research direction

Trace the Nomad configuration handling for vault.cert_file and vault.key_file, then compare it with the other certificate paths during SIGHUP reload. Reproduce or verify the reported behavior and update the reload path so those certificates are reread on SIGHUP; done means renewed certificates are used after reload.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.