hashicorp / hashicorp/vault

Vault template print the same log again and again

Open
#31,444 1 comment 0 reactions 0 assignees View on GitHub
agent bug
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

**Describe the bug**

When I use Vault template, a single `spew_printf`, even completely outside of any loop, will be printed randomly multiple times.

This makes the output not readable and very confusing.

**To Reproduce**
Steps to reproduce the behavior:

1. Start a dev vault

```bash
./vault server -dev -dev-root-token-id root
```

2. Write some testing KV

```bash
export VAULT_ADDR="http://127.0.0.1:8200"
export VAULT_TOKEN="root"
for i in {1..10}; do
for s in {1..10}; do
vault kv put -mount=secret override${i}/secret${s} data=$i
done
done
```

3. Setup a template and a Vault configure

```bash
echo root > token

# content of tmpl.hcl
vault {
address = "http://localhost:8200"
}
auto_auth {
method {
type = "token_file"
config = {
token_file_path = "token"
}
}
}
log_level = "info"
exit_after_auth = true
template_config {
exit_on_retry_failure = true
}
template {
source = "test.gotmpl"
destination = "test.out"
}

# content of test.gotmpl
{{ spew_printf "ONLY_PRINT_ONCE\n" }}
{{ $mount := "secret" }}
{{ $cascade_paths := sprig_list
"override1"
"override2"
"override3"
"override4"
"override5"
"override6"
"override7"
"override8"
"override9"
"override10"
-}}
{{ range $cascade_paths -}}
{{ $secret_dir := . -}}
{{ spew_printf "listing %v\n" $secret_dir -}}
{{ range secrets ( printf "%s/metadata/%s" $mount $secret_dir ) -}}
{{ $secret_name := . -}}
{{ $path := ( printf "%s/data/%s/%s" $mount $secret_dir . ) -}}
{{ $metadatapath := ( printf "%s/metadata/%s/%s" $mount $secret_dir . ) -}}
{{ with secret $metadatapath -}}
{{ spew_printf " found secret: %q\n" $path -}}
{{ end -}}
{{ end -}}
{{ end -}}
```

4. Run Vault

```
vault agent -config tmpl.hcl
```

And you get a really messed up output:

`vault agent -config v.hcl | grep -c ONLY_PRINT_ONCE` gives a random number from 0~20 or more.

**Expected behavior**

Expected output should be

```
ONLY_PRINT_ONCE
listing override1
found secret ...
found secret ...
listing override2
found secret ...
found secret ...
```

**Environment:**
* Vault Server Version (retrieve with `vault status`): 1.19.3
* Vault CLI Version (retrieve with `vault version`): 1.19.3
* Server Operating System/Architecture: both macOS and Ubuntu

Vault server configuration file(s):

start with `-dev`

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Start with the Vault Agent command and the template configuration shown in the reproduction, then run the provided dev-server and template steps to observe repeated spew_printf output. Trace why a single print is emitted multiple times, and verify that the command produces each expected line once, including ONLY_PRINT_ONCE.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.