hashicorp / hashicorp/vault-action
[BUG] PKI certificate retrieval fails if pki backend does not provide `ca_chain`
- Dominant language
- JavaScript
- Stars
- 513
- Forks
- 166
- Avg merge
- 6d 4h
- Merged PRs (30d)
- 1
Description
## Vault server version
v1.4
## vault-action version
v2.0.0
## Describe the bug
PKI certificate fails after retrieval when no `ca_chain` is present.
I can see the action is retrieving the certificate (prints the fingerprint) but then fails in the action when its processed: `Error: Cannot read properties of undefined (reading 'join')`
Vault API marks the `ca_chain` property as optional.
```go
"ca_chain": {
Type: framework.TypeCommaStringSlice,
Description: `Certificate Chain`,
Required: false,
},
```
https://github.com/hashicorp/vault/blob/0bebe0058ddd6601dcf5aaff6baf2092f076f9db/builtin/logical/pki/path_issue_sign.go#L73-L77
The vault-action assumes it is always there as it [iterates of the `outputMap`](https://github.com/hashicorp/vault-action/blob/892a26828f195e65540a40b4768ae4571f51ebfc/src/pki.js#L62) without checking that the `ca_chain` fields is actually present.
Then the [`ca_chain` concatenation](https://github.com/hashicorp/vault-action/blob/main/src/pki.js#L14) part fails
## To Reproduce
The yaml of the `vault-action` step, with any sensitive information masked or removed.
```yaml
- name: Setup Nomad TLS Environment Variables
id: nomad-tls
uses: hashicorp/vault-action@v4.0.0
with:
url: "...."
method: approle
path: "..."
roleId: ${{ }}
secretId: ${{ }}
# this does not provide a ca_chain property
pki: |
my-tls-path/issue/cli {"common_name": "cli", "ttl": "10m"} ;
```
## Expected behavior
It should create the tls parts and not fail
## Log Output
```
....
Token Info
::add-mask::***
✔ Successfully generated certificate (serial number )
::endgroup::
Error: Cannot read properties of undefined (reading 'join')
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/pki.js at the ca_chain concatenation and the outputMap iteration referenced by the issue. Reproduce the action with a PKI response that omits ca_chain, then verify that the supplied certificate and TLS parts are created without the undefined join error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, javascript
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100