Template auth/token/create "metadata": '' expected a map, got 'string'

Rendanic · January 1, 2023, 9:46pm

I want to create tokens with a template in vault agent.

It is working until I add the option for metadata.
Example:
VAULT_TOKEN={§ with secret "/auth/token/create" "policies=auth-role-nomad" "metadata={attr1=value}" "no_default_policy=true" "ttl=96h" §}{§ .Auth.ClientToken §}{§ end §}

The error:
Field validation failed: error converting input {attr1=value} for field "metadata": '' expected a map, got 'string'

I tried a lot of different formats but can’t find a worklng solution.

My question:
What is the right syntax in the template for an attribute of type map?

Regards
Thorsten

maxb · January 1, 2023, 9:56pm

The secret function in consul-template (which implements the template processing that Vault agent uses) is not capable submitting nested map values to the Vault API. The code, which can be seen here:

github.com

hashicorp/consul-template/blob/07e568a1181aa70c93f3927fcc90c801ee19fe9e/template/funcs.go#L405-L417


      
          		data := make(map[string]interface{})
          		for _, str := range rest {
          			if len(str) == 0 {
          				continue
          			}
          			parts := strings.SplitN(str, "=", 2)
          			if len(parts) != 2 {
          				return nil, fmt.Errorf("not k=v pair %q", str)
          			}
          
          
			k, v := strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1])
          			data[k] = v
          		}

only supports string values.

It is not possible to use Vault agent, as currently written, to make this API call including metadata.

Rendanic · January 2, 2023, 5:06am

Not the answer I expected but good to know that it is not working with a template.

Thanks for the fast answer.

Topic		Replies	Views
Vault agent template: supplying map field to the ssh ca secret engine Vault consul-template , vault , consul-vault	0	144	January 5, 2024
Does the Vault provider support token metadata? Terraform Providers	0	315	December 6, 2019
Dynamic annotations for Vault secrets Terraform k8s , vault	0	834	July 21, 2021
Vault agent rendering fails with bad syntax error Vault k8s , consul-template	1	1492	February 14, 2023
Preflight error with templated policy Vault vault	1	528	April 14, 2021

Template auth/token/create "metadata": '' expected a map, got 'string'

Related topics