hashicorp-vault - 保管库代理模板不呈现消息缺少依赖项 : vault. 写入

Question

Vault 代理 v1.4.2 服务在 systemctl 下运行时无法呈现模板和创建文件。

但是相同的模板渲染按预期使用保险库代理服务中使用的命令工作

/opt/vault/bin/vault agent -config/opt/vault/config/default.hcl -log-level=info

所以看起来 OS systemctl 无法按照直接执行时的方式执行命令。

cat /etc/systemd/system/vault.service
[Unit]
Description=\"HashiCorp Vault Agent\"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/opt/vault/config/default.hcl
[Service]
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/opt/vault/bin/vault agent -config /opt/vault/config/default.hcl -log-level=debug
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitIntervalSec=60
StartLimitBurst=3
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

journalctl -u vault
  [DEBUG] (runner) running initial templates
 [DEBUG] (runner) initiating run
 [DEBUG] (runner) checking template 749c1d765e84e3e67f9dbb98ec983bf1
 [DEBUG] (runner) missing data for 1 dependencies
 **[DEBUG] (runner) missing dependency: vault.write(pki_int/test/issue/com -> 02a1cc85)**
 [DEBUG] (runner) add used dependency vault.write(pki_int/test/issue/com -> 02a1cc85) to missing since isLeader but do not have a watcher
 [DEBUG] (runner) was not watching 1 dependencies
 [DEBUG] (watcher) adding vault.write(pki_int/test/issue/com -> 02a1cc85)
 [DEBUG] (runner) checking template 43304cf2b8e3710476a7972b03a7544e
 [DEBUG] (runner) missing data for 1 dependencies
 [DEBUG] (runner) missing dependency: vault.write(pki_int/test/issue/com -> 02a1cc85)
 [DEBUG] (runner) missing data for 1 dependencies
 [DEBUG] (runner) checking template ca2b67db58c83f0e184663098bcb74b8
 [DEBUG] (runner) rendering "(dynamic)" => "/tmp/abc.test"
 [INFO] (runner) rendered "(dynamic)" => "/tmp/abc.test"
 [DEBUG] (runner) diffing and updating dependencies
 [DEBUG] (runner) watching 1 dependencies
 [INFO]  auth.handler: renewed auth token
 [DEBUG] Found certificate and set lease duration to 150 seconds
 [DEBUG] (runner) receiving dependency vault.write(pki_int/test/issue/com -> 02a1cc85)
 [DEBUG] (runner) initiating run
 [DEBUG] (runner) checking template 749c1d765e84e3e67f9dbb98ec983bf1
 [DEBUG] (runner) rendering "/opt/vault/templates/test.cert.tpl" => "/tmp/test.cert.pem"
 [INFO] (runner) rendered "/opt/vault/templates/test.cert.tpl" => "/tmp/test.cert.pem"
 [DEBUG] (runner) checking template 43304cf2b8e3710476a7972b03a7544e
 [DEBUG] (runner) rendering "/opt/vault/templates/test.key.tpl" => "/tmp/test.key.pem"
 [INFO] (runner) rendered "/opt/vault/templates/test.key.tpl" => "/tmp/test.key.pem"
 [DEBUG] (runner) checking template ca2b67db58c83f0e184663098bcb74b8
 [DEBUG] (runner) rendering "(dynamic)" => "/tmp/abc.test"
 [DEBUG] (runner) diffing and updating dependencies
 [DEBUG] (runner) vault.write(pki_int/test/issue/com -> 02a1cc85) is still needed
 [DEBUG] (runner) watching 1 dependencies
 [DEBUG] (runner) all templates rendered

模板

test-cert.tpl
{{- /* test.abc.com.cert.tpl */ -}}
{{ with secret "pki_int/test/issue/abc.com" "common_name=test.abc.com" "ttl=2m" }}
{{ .Data.certificate }}
{{ .Data.issuing_ca }}{{ end }}

test-key.tpl
{{ with secret "pki_int/test/issue/abc.com" "common_name=test.abc.com" "ttl=2m" }}
{{ .Data.private_key }}{{ end }}
{{- /* test.abc.com.key.tpl */ -}}

test.tpl
{{ with secret "pki_int/test/issue/abc.com" "common_name=test.abc.com" "ttl=2m" }}
{{ .Data.private_key }}{{ end }}
abc123
To Reproduce
Steps to reproduce the behavior:

Run systemctl restart vault
Run journalctl -u vault
See error
Expected behavior
I expected it to create the following files with certs

/tmp/test.cert.pem
/tmp/test.key.pem
/tmp/abc.test"

环境:

Vault 服务器版本(使用 vault 状态检索):1.4.2

Vault CLI 版本(使用 vault 版本检索):v1.4.2

服务器操作系统/架构:Red Hat Enterprise Linux Server release 7.8 (Maipo)]

保险柜代理配置文件:

cat /opt/vault/config/default.hcl
pid_file   = "/opt/vault/data/vault-pid"
vault {
  address = "https://xxxxxxxxx:443"
}
auto_auth {
  method "aws" {
    mount_path = "auth/aws"
    config = {
      type = "iam"
      role = "test-iam-role"
    }
  }
  sink "file" {
    config = {
      path = "/opt/vault/data/vault-token"
    }
  }
}
template {
  source      = "/opt/vault/templates/test.cert.tpl"
  destination = "/tmp/test.cert.pem"
  perms       = "0600"
}

template {
  source      = "/opt/vault/templates/test.key.tpl"
  destination = "/tmp/test.key.pem"
  perms       = "0600"
}

template {
  contents     = "testabc"
  destination = "/tmp/abc.test"
}

附加上下文

我已经屏蔽了数据以删除原始域的引用，所以如果有任何不匹配请考虑。

Answer 1

我设法通过将证书文件的位置从“/tmp”更改为“/opt/vault/certs”来解决这个问题，并解决了这个问题。