hashicorp / hashicorp/vault-action

[BUG] PKI certificate retrieval fails if pki backend does not provide `ca_chain`

Open Beginner friendly
#609 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
513
Forks
166
Avg merge
6d 4h
Merged PRs (30d)
1

Description

## Vault server version
v1.4

## vault-action version
v2.0.0

## Describe the bug
PKI certificate fails after retrieval when no `ca_chain` is present.

I can see the action is retrieving the certificate (prints the fingerprint) but then fails in the action when its processed: `Error: Cannot read properties of undefined (reading 'join')`

Vault API marks the `ca_chain` property as optional.
```go
"ca_chain": {
Type: framework.TypeCommaStringSlice,
Description: `Certificate Chain`,
Required: false,
},
```
https://github.com/hashicorp/vault/blob/0bebe0058ddd6601dcf5aaff6baf2092f076f9db/builtin/logical/pki/path_issue_sign.go#L73-L77

The vault-action assumes it is always there as it [iterates of the `outputMap`](https://github.com/hashicorp/vault-action/blob/892a26828f195e65540a40b4768ae4571f51ebfc/src/pki.js#L62) without checking that the `ca_chain` fields is actually present.
Then the [`ca_chain` concatenation](https://github.com/hashicorp/vault-action/blob/main/src/pki.js#L14) part fails

## To Reproduce
The yaml of the `vault-action` step, with any sensitive information masked or removed.
```yaml
- name: Setup Nomad TLS Environment Variables
id: nomad-tls
uses: hashicorp/vault-action@v4.0.0
with:
url: "...."
method: approle
path: "..."
roleId: ${{ }}
secretId: ${{ }}
# this does not provide a ca_chain property
pki: |
my-tls-path/issue/cli {"common_name": "cli", "ttl": "10m"} ;
```
## Expected behavior

It should create the tls parts and not fail

## Log Output

```
....
Token Info
::add-mask::***
✔ Successfully generated certificate (serial number )
::endgroup::

Error: Cannot read properties of undefined (reading 'join')
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/pki.js at the ca_chain concatenation and the outputMap iteration referenced by the issue. Reproduce the action with a PKI response that omits ca_chain, then verify that the supplied certificate and TLS parts are created without the undefined join error.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
ci-cd, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.