hashicorp / consul-template

Template rendering, notifier, and supervisor for @HashiCorp Consul and Vault data.
https://www.hashicorp.com/
Mozilla Public License 2.0
4.76k stars 783 forks source link

Consul-template doesn't to re-read value from Vault #1689

Open 7309766 opened 1 year ago

7309766 commented 1 year ago

Consul Template version

consul-template v0.29.6 (e4f5d58)

Configuration

vault {
  address = "https://myvault"
  token = "mytoken"
  renew_token = true
  lease_renewal_threshold = 0.0001

}

pid_file = "/run/consul-template.pid"
log_level = "INFO"
syslog {
  enabled = true
  facility = "LOCAL5"
}
template {
    command = "sudo /opt/consul-template/scripts/myscript.sh "
    destination = "/opt/consul-template/scripts/myscript.sh"
    perms = "755"
    source = "/opt/consul-template/templates/myscript.sh.tpl"
  }
 {{ range secrets "main/env/users" }}
     {{ with secret (printf "main/env/users/%s" .)  }}
     echo "For {{ .Data.name }} now value1 this is {{ .Data.value1 }}"
{{ end }}{{ end }}

{{ with secret "main/env/users/user1"  }}
echo "---direct ----- for {{ .Data.name }} now value this is {{ .Data.value }}"
{{ end }}

{{ with secret  "main/env/users/user2"  }}
echo "---direct ----- for {{ .Data.name }} now value this is {{ .Data.value }}"
{{ end }}

in Vault storage (kv1 Secret engine) created 2 secrets: main/env/users/user1 and main/env/users/user1 with same keys and different values : name={user1,users2} and value={value1, value2} accordingly.

Expected behavior

1 ) Consul-template should read data from secretes. 2) After changed value in Vaul -> Consul-template should update the value in template.

Actual behavior

1) Consul-template has read data from secrets and rendered correctly: echo "For user1 now value1 this is value1 " echo "For user2 now value1 this is value2 " 2) After changing the value in Vault Consul-template uses/renders old value

Steps to reproduce

  1. Create secret in Vault and use it in Consul-template
  2. Change only value in Vault
  3. Check logs or rendered template
phemmer commented 1 year ago

See #1423