Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Listing a KV V2 directory doesn't work when pointing to a Vault agent #6784

Closed
jordiclariana opened this issue May 24, 2019 · 2 comments
Closed

Comments

@jordiclariana
Copy link

Describe the bug
Vault API documentation claims that using LIST method or ?list=true query string are interchangeable and produce the same result. That is true but when using a vault agent in between the client and the server it doesn't work.
Using the LIST method works as expected while the query string list=true returns a 404.

vault command uses only the query string list=true, so it doesn't work when pointing to an agent:

$ vault kv list kv/mydir
No value found at kv/metadata/mydir
$ vault kv list -output-curl-string kv/mydir
curl http://127.0.0.1:8200/v1/kv/metadata/mydir?list=true

While using curl with LIST method does work:

$ curl -X LIST -vs http://127.0.0.1:8200/v1/kv/metadata/mydir | jq '.'
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 8200 (#0)
> LIST /v1/kv/metadata/mydir HTTP/1.1
> Host: 127.0.0.1:8200
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Cache-Control: no-store
< Content-Length: 173
< Content-Type: application/json
< Date: Fri, 24 May 2019 13:59:30 GMT
< X-Cache: MISS
< 
{ [173 bytes data]
* Connection #0 to host 127.0.0.1 left intact
{
  "request_id": "b1a7b22d-fa76-e142-36b0-e4205a3687da",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "keys": [
      "mykey"
    ]
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}

To Reproduce

  1. You need to have the current setup, which is not easy to reproduce here:
  • Machine A with Vault Server
  • Machine B with Vault Agent connected and authenticated to Machine A Vault Server
  1. Run on Machine A: vault kv put kv/mydir/mykey name=value
  2. Run on Machine B: vault kv list kv/mydir. It returns: No value found at kv/metadata/mydir. This doesn't list the directory.
  3. Run on Machine B: curl -XLIST -s http://127.0.0.1:8200/v1/kv/metadata/mydir. This does list the directory.

Expected behavior
vault kv list kv/mydir should list the keys in the directory when pointing to a Vault Agent

Environment:

  • Vault Server Version (retrieve with vault status):
Key                      Value
---                      -----
Recovery Seal Type       shamir
Initialized              true
Sealed                   false
Total Recovery Shares    1
Threshold                1
Version                  1.1.2
Cluster Name             vault-cluster-4db0f02c
Cluster ID               b5cd54b2-7d43-0690-fe26-1daeec8e091e
HA Enabled               true
HA Cluster               https://vault.service.consul:8201
HA Mode                  active
  • Vault CLI Version (retrieve with vault version):
Vault v1.1.2 ('0082501623c0b704b87b1fbc84c2d725994bac54')
  • Server Operating System/Architecture: Ubuntu 16.04 x86_64

Vault server configuration file(s):
Given the fact that everything works well when run without the Vault agent, I'll post only the agent config.

Agent:

pid_file = "/var/run/vault-agent/vault-agent.pid"

auto_auth {
   method "aws" {
       mount_path = "auth/aws"
       config = {
           type = "iam"
           role = "myrole"
       }
   }

   sink "file" {
       config = {
           path = "/etc/vault/token"
       }
   }
}

vault {
   address = "https://vault:8200"
}

cache {
        use_auto_auth_token = true
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = true
}
@briankassouf
Copy link
Contributor

already should be fixed by #6772

@jordiclariana
Copy link
Author

Awesome, thanks! I missed that PR and its related ticket.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants