[ASK] Vault Agent Templating Error 'exec' expected a map, got 'slice'

petrukngantuk1 · June 22, 2022, 11:54am

Hi,

we have vault agent template stanza like :

template {
  source               = "/opt/vault/secrets/templates/consul-systemd.service.ctmpl"
  destination          = "/etc/systemd/system/consul.service"
  create_dest_dirs     = false
  error_on_missing_key = true
  perms                = 0644
  backup               = true
  exec = {
    command = ["/opt/vault/scripts/systemd-reloader", "consul"]
    timeout = "30s"
  }
}

error log :

root@ip-10-9-216-18:/opt/vault# /opt/vault/bin/vault agent -config /opt/vault/config/default.hcl -log-level=info
Error loading configuration from /opt/vault/config/default.hcl: error parsing 'template': 1 error(s) decoding:

* 'exec' expected a map, got 'slice'

trying another template :

...
template {
  source               = "/opt/vault/secrets/templates/consul-systemd.service.ctmpl"
  destination          = "/etc/systemd/system/consul.service"
  create_dest_dirs     = false
  error_on_missing_key = true
  perms                = 0644
  backup               = true
  exec {
    command = "/opt/vault/scripts/systemd-reloader consul"
    timeout = "30s"
  }
}

...

still have same error too,
anyone can help us to configure correct exec config ?

based on the docs https://www.vaultproject.io/docs/agent/template#exec seem the former is the correct one, but no luck

aram · June 23, 2022, 9:08am

github.com

hashicorp/consul-template/blob/main/docs/configuration.md#exec-mode

# Configuring Consul Template

Consul Template can be configured with command line flags and configuration
files. The CLI interface supports most options in the configuration file and
vice-versa. We suggest keeping the usage of CLI flags brief for readability
purposes, and using a configuration file for more complex and longer
configuration.

- [Command Line Flags](#command-line-flags)
- [Configuration File](#configuration-file)
- [Configuration Options](#configuration-options)
  - [Consul Template](#consul-template)
  - [Consul](#consul)
  - [Vault](#vault)
  - [Templates](#templates)
  - [Consul Template Modes](#modes)
    - [Once Mode](#once-mode)
    - [De-Duplication Mode](#de-duplication-mode)
    - [Exec Mode](#exec-mode)

This file has been truncated. show original

exec {
  command = ["/usr/bin/app"]
}

petrukngantuk1 · June 28, 2022, 4:35am

whats that mean @aram , could you elaborate more?

per my understanding, it will not work if we use flag ? in the exec.command section?

but in the docs consul-template/modes.md at v0.28.1 · hashicorp/consul-template · GitHub and consul-template/configuration.md at v0.28.1 · hashicorp/consul-template · GitHub , it can use flag

johnalotoski · July 6, 2022, 4:44pm

This seems to be a bug. I just ran into the same problem and am also looking for the solution.

johnalotoski · July 6, 2022, 6:40pm

Issue submitted to GH:

github.com/hashicorp/vault

vault template stanza exec object appears to not parse correctly

opened 06:40PM - 06 Jul 22 UTC

johnalotoski

The vault documentation for a template stanza describes the [exec](https://www.v…aultproject.io/docs/agent/template#exec) declaration as: ``` [exec](https://www.vaultproject.io/docs/agent/template#exec) (object: optional) - The exec block executes a command when the template is rendered and the output has changed. The block parameters are command (string slice: required) and timeout (string: optional, defaults to 30s). ``` For vault `v1.11.0` with consul-template `0.29.0`, the consul template config [docs](https://github.com/hashicorp/consul-template/blob/v0.29.0/docs/configuration.md) show the exec hcl block example as: ``` template { # ... # This is the optional exec block to give a command to be run when the template # is rendered. The command will only run if the resulting template changes. # The command must return within 30s (configurable), and it must have a # successful exit code. # See the Exec section below and the Commands section in the README for more. exec { command = ["restart", "service", "foo"] timeout = "30s" } } ``` The JSON equivalent (what we are using for config submission to vault-agent) for the exec block should be: ``` ... "exec": [ { "command": [ "restart", "service", "foo" ], "timeout": "30s" } ], ... ``` However, this JSON produces the error: ``` Error loading configuration from $FILE.json: error parsing 'template': 1 error(s) decoding: * 'exec' expected a map, got 'slice' ``` I cannot seem to change the JSON in any manner to get the exec declaration to parse correctly. Another user independently reported the same issue in the hashicorp discussion channel [here](https://discuss.hashicorp.com/t/ask-vault-agent-templating-error-exec-expected-a-map-got-slice/41074/2). For now, falling back to use of the deprecated `command` (string) is a workaround. **Environment:** Vault v1.11.0 (ea296ccf58507b25051bc0597379c467046eb2f1), built 2022-06-17T15:48:44Z NixOS, x86_64-linux

johnalotoski · July 6, 2022, 8:23pm

Fix PR merged to main – should be fixed in the next GA release.

hsimon-hashicorp · July 6, 2022, 8:41pm

Thank you very much for reporting this to us on GitHub, John!