VAULT-528 Fix issue with consul-template not rendering secrets with delete_version_after set on them #1879
Conversation
…elete_version_after set on them
| @@ -5,6 +5,7 @@ NEW FEATURES: | |||
|
|
|||
| BUG FIXES: | |||
| * Fetch services query not overriding opts correctly [NET-7571](https://hashicorp.atlassian.net/browse/NET-7571) | |||
| * Consul-template now correctly renders KVv2 secrets with `delete_version_after` set [NET-3777](https://hashicorp.atlassian.net/browse/NET-3777) | |||
There was a problem hiding this comment.
I spotted this as part of researching the bug. I've been doing the work under VAULT-528, but I'm happy to close NET-3777 as a duplicate or something once I merge this. However you folks want to handle it and whatever best fits your process!
There was a problem hiding this comment.
Please do close NET-3777, this essentially fixes what has been reported.
dependency/vault_read.go
Outdated
| return md["deletion_time"] != "" | ||
| deletionTime, ok := md["deletion_time"].(string) | ||
| if !ok { | ||
| // Not a string, end early |
There was a problem hiding this comment.
| // Not a string, end early | |
| // key not present, end early |
There was a problem hiding this comment.
Since we're casting to a string, we'll only go down the !ok codepath will only be gone down if the key isn't present or the value isn't a string. I'll improve the comment to show that it could be both :)
There was a problem hiding this comment.
Updated! Please let me know if there's anything else you'd need before approving :)
| "deletion_time": "foo", | ||
| }, | ||
| }, | ||
| })) |
There was a problem hiding this comment.
I'd add two more tests that confirm:
- that if metadata is missing,
falseis returned from deletedKVv2 - that if metadata's type is something other than
map[string]interface{},falseis returned from deletedKVv2
There was a problem hiding this comment.
Thank you! Added both :)
Some background:
Initially, Vault secrets would only have
deletion_timeset on them if they'd been deleted. Since then, it has become possible to set deletion time in the future, usingdelete_version_afterto indicate that a secret 'will' be deleted. As a result, the old logic to assume a secret is deleted if it has a deletion time has become naive.Resolves #1789
Resolves #1778
Resolves https://discuss.hashicorp.com/t/consul-template-not-returning-vault-kv-items-with-deletion-time-set/55763