Unable to lookup the vault credentials via lookuptemplates

[gowrisankar22]

Hi @alexandergurney
something weird happening. When I used fixed prefixpath /concourse everything worked but when I switched to lookup templates to custom path login is successful but lookup to the password is not happening. Not sure what I am missing over here.

Let me elaborate my configurations,

1. my lookup template and prefix path is like below

namespace: system/concourse
pathPrefix: /prod-system
lookupTemplates: ["/{{.Team}}/concourse/{{.Pipeline}}/{{.Secret}}", "/{{.Team}}/concourse/{{.Secret}"]

2. enabled kv engine using below command .
   vault secrets enable -version=1 -path=prod-system kv

3. my Policy looks like below,

path "prod-system/*" {
  policy = "read"
}
vault policy write prod-system ./concourse-policy.hcl

4. I am connecting via approle. Below are the steps i did to enable the same.

vault auth enable approle
vault write auth/approle/role/prod-system policies=prod-system period=1h

5. I generated roleid and secredid via below commands,

vault read auth/approle/role/concourse/prod-system
vault write -f auth/approle/role/concourse/prod-system

6. With the above configuration, I connected vault with concourse successfully. I can see the logs in the Webnode.

{"timestamp":"2020-06-10T13:31:59.300987060Z","level":"info","source":"atc","message":"atc.credential-manager.configured credentials manager","data":{"name":"vault","session":"6"}}
{"timestamp":"2020-06-10T13:31:59.653922075Z","level":"info","source":"atc","message":"atc.credential-manager.login.succeeded","data":{"lease-duration":3600,"name":"vault","policies":["prod-system","default"],"session":"6.1","token-accessor":"rKmQVlagyqLnfbE4TOWSWs8V.GNy9I"}}

7. I have created secrets to test using
   vault kv put prod-system/main/concourse test=DM password=abcd1234 and
   vault kv put prod-system/main/concourse/mypipeline test=DM password=abcd1234

8. when i tried testing via pipeline it is unable to interpolate the secretfailed to interpolate task config: undefined vars: password. my pipeline looks like below,

jobs:
- name: test-vault
  plan:
  - task: vault
    params:
      pwd: ((password))
      test: ((test))
    config:
      platform: linux
      image_resource:
        type: registry-image
        source:
          repository: alpine
          tag: latest
      run:
        path: sh
        args:
        - -exc
        - |
          echo "$pwd $test"

Could you please help, to identify the problem. ?

[vito]

((password)) means that you need a path that ends with /password, not a key that contains a password= field.

Instead, your vault kv put commands should look like this:

vault kv put prod-system/main/concourse/test value=DM
vault kv put prod-system/main/concourse/password value=abcd1234
vault kv put prod-system/main/concourse/mypipeline/test value=DM
vault kv put prod-system/main/concourse/mypipeline/password value=abcd1234

Or if you'd like to store them in the same key, you would do this:

vault kv put prod-system/main/concourse/mypipeline/foo test=DM password=abcd1234

And access them like ((foo.test)) and ((foo.password)).

[gowrisankar22]

@vito @alexandergurney

I have tried but it is not working. it was unable to interpolate the variable still. Also, I found that another issue opened by someone. May be is this related due to broken approle ?

concourse/concourse-chart#113

{"timestamp":"2020-06-10T22:18:23.296098384Z","level":"info","source":"atc","message":"atc.tracker.track.errored","data":{"build":18537,"error":"failed to interpolate task config: undefined vars: foo","job":"test-vault","pipeline":"test_demo","session":"23.41"}}

[gowrisankar22]

@jamieklassen Then given example is wrong?
https://github.com/concourse/concourse-chart/blob/master/values.yaml#L484-L485

should I change to
"/{{.Team}}/concourse/{{.Pipeline}}/{{.Secret}}, /{{.Team}}/concourse/{{.Secret}" ?

[jamieklassen]

my theory is that the example is wrong. i haven't tested it, and you seem to have more time to test this than i do, so I'm asking you to try it out. but you should do "/{{.Team}}/concourse/{{.Pipeline}}/{{.Secret}},/{{.Team}}/concourse/{{.Secret}" with no space, following the docs exactly

[gowrisankar22]

@jamieklassen sure. I will try this as a first thing tomorrow morning and update the conversation here.

[gowrisankar22]

@jamieklassen it worked with just one array string. I fixed the example.

PR: concourse/concourse-chart#116

[jamieklassen]

thanks!