Configurable Vault default lease duration #1040
Labels
Comments
|
Hi @msessa Thank you for opening an issue. Could you please share your Consul Template configuration file and Vault setup? |
|
Hi @sethvargo Sure. here's the full list of steps to reproduce: ➜ docker run -d --name vaultdev -p 8200:8200 vault:0.8.3
2f8e5b61037149c8f13351d5a4cc315b92fdf4c9947dc5c61c505718403678ce
➜ docker logs vaultdev 2>&1 | grep Root
Root Token: 0c8360d5-813e-feee-c9f0-5d1230444c71
➜ export VAULT_TOKEN=0c8360d5-813e-feee-c9f0-5d1230444c71
➜ export VAULT_ADDR=http://127.0.0.1:8200
➜ vault mount transit
Successfully mounted 'transit' at 'transit'!
➜ vault write -f transit/keys/test
Success! Data written to: transit/keys/test
➜ vault write -f transit/encrypt/test plaintext="$(echo test data goes here | base64)"
Key Value
--- -----
ciphertext vault:v1:sdXnJN2VVBCBH+FAEoVVGp5tlan3NzP/KAcU43Hx2tedvHOHUO1TFiunXXBDi+JZ
➜ echo 'vault:v1:sdXnJN2VVBCBH+FAEoVVGp5tlan3NzP/KAcU43Hx2tedvHOHUO1TFiunXXBDi+JZ' > encrypted_file
➜ cat template.ctmpl
{{ $content := file "./encrypted_file" }}
{{ $data := printf "ciphertext=%s" $content }}
{{ with secret "transit/decrypt/test" $data }}
{{ .Data.plaintext | base64Decode }}
{{ end }}
➜ consul-template -vault-renew-token=false -log-level=trace -dry -template template.ctmpl:decrypted_fileFollowing is an extract from the log from the above command. As you can see the decryption operation is performed repeatedly even when the source ( That can put a considerable load on vault when dealing with a large number of encrypted files. |
|
Hmm I see. Consul Template wasn't really designed to work with the transit backend - more the dynamic secrets backends (like database) and the static secret (secret/). I'll take a look at this and see what we can do. Also, you can set the initial root token via |
|
Given we haven't heard anything based on our suggestions/questions above I'm going to close this issue, but I encourage you to comment and we can re-open it if you want to pick this up again. Alternatively, if things have changed dramatically, feel free to create a new issue or PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We use vault-template to decrypt data using the transit backend which returns a non-renewable secret with lease_duration=0.
consul-template already detects changes in the source file (the encrypted data) and triggers decryption when needed, however it also performs a lot of unnecessary decryption operations because of the short default lease duration.
I believe this is the line where it's hardcoded:
consul-template/dependency/vault_common.go
Line 13 in 26d029a
Would it be possible to parametrize
VaultDefaultLeaseDurationat CLI or config level?Thanks in advance.
The text was updated successfully, but these errors were encountered: