VAULT-528 Fix issue with consul-template not rendering secrets with delete_version_after set on them

CHANGELOG.md

@@ -5,6 +5,7 @@ NEW FEATURES:
 
 BUG FIXES:
 * Fetch services query not overriding opts correctly [NET-7571](https://hashicorp.atlassian.net/browse/NET-7571)
+* Consul-template now correctly renders KVv2 secrets with `delete_version_after` set [NET-3777](https://hashicorp.atlassian.net/browse/NET-3777)
 
 ## v0.36.0 (January 3, 2024)
 

dependency/vault_read.go

@@ -176,7 +176,20 @@ func (d *VaultReadQuery) readSecret(clients *ClientSet) (*api.Secret, error) {
 func deletedKVv2(s *api.Secret) bool {
 	switch md := s.Data["metadata"].(type) {
 	case map[string]interface{}:
-		return md["deletion_time"] != ""
+		deletionTime, ok := md["deletion_time"].(string)
+		if !ok {
+			// Not a string, end early
+			return false
+		}
+		t, err := time.Parse(time.RFC3339, deletionTime)
+		if err != nil {
+			// Deletion time is either empty, or not a valid string.
+			return false
+		}
+
+		// If now is 'after' the deletion time, then the secret
+		// should be deleted.
+		return time.Now().After(t)
 	}
 	return false
 }

dependency/vault_read_test.go

@@ -711,3 +711,63 @@ func TestShimKVv2Path(t *testing.T) {
 		})
 	}
 }
+
+// TestDeletedKVv2 tests that deletedKVv2 returns true and false
+// in the correct scenarios.
+func TestDeletedKVv2(t *testing.T) {
+	// Intentionally using string literals here since they are taken
+	// directly from Vault's API.
+	assert.True(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"deletion_time": "2022-06-15T20:23:40.067093Z",
+			},
+		},
+	}))
+	assert.True(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"deletion_time": "2019-06-19T20:56:35.662563Z",
+			},
+		},
+	}))
+
+	// It should work with any RFC3339 formatted string
+	assert.True(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"deletion_time": time.Now().Add(-1 * time.Hour).Format(time.RFC3339),
+			},
+		},
+	}))
+
+	assert.False(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"deletion_time": time.Now().Add(time.Hour).String(),
+			},
+		},
+	}))
+
+	// Edge cases:
+	assert.False(t, deletedKVv2(&api.Secret{}))
+	assert.False(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{},
+		},
+	}))
+	assert.False(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"deletion_time": "",
+			},
+		},
+	}))
+	assert.False(t, deletedKVv2(&api.Secret{
+		Data: map[string]interface{}{
+			"metadata": map[string]interface{}{
+				"deletion_time": "foo",
+			},
+		},
+	}))
+}