hashicorp / hashicorp/vault

Vault Agent aborts evaluation of all temlates and reschedules all if one fails

Open
#32,035 0 comments 1 reaction 0 assignees View on GitHub
agent bug secret/nomad
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

**Describe the bug**
If using Vault Agent to render multiple templates, if one fails then all of the other ones are aborted. Then, even the successfully rendered templates are also rescheduled to run again. This is problematic when combined with `exec {}` blocks within the template as those are also re-executed on all rescheduled templates which on our case causes the nomad agents to [constantly restart](https://github.com/hashicorp/nomad/issues/4593).

**To Reproduce**
Steps to reproduce the behavior:
1. Write two `template {}` blocks for Vault Agent
2. Make one of them contain an `exec {}` template that always fails
3. See that both templates keep re-rendering despite only one failing, alternatively that the functioning one never renders at all.

**Expected behavior**
Only the failing template should fail and be rescheduled, not all templates.

**Environment:**
* Vault Server Version (retrieve with `vault status`): v2.0.1
* Vault CLI Version (retrieve with `vault version`): v2.0.3
* Server Operating System/Architecture: Ubuntu 24.04

**Additional context**
N/A

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with two Vault Agent template blocks, including one failing exec block, then trace the template evaluation and rescheduling path. Done means the failing template is retried without aborting or rescheduling templates that rendered successfully, and the working template renders once.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.