Error when using templates

[paulrostorp]

I'm getting an error when using templates with the injector, I cannot find any documentation to enlighten me...
When injecting directly through annotations (like so: "vault.hashicorp.com/agent-inject-secret-demo: "demo/secret") I get no error, but when using a template (both in annotation or configmap) I get this error:

Error loading configuration from /vault/configs/config-init.hcl: At 22:44: expected '/' for comment

Here is my the configmap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-configmap
  labels:
    app: hello
data:
  config.hcl: |
    "auto_auth" = {
      "method" = {
        "config" = {
          "role" = "demo"
        }
        "type" = "kubernetes"
      }

      "sink" = {
        "config" = {
          "path" = "/vault/.token"
        }

        "type" = "file"
      }
    }

    "exit_after_auth" = false
    "pid_file" = "/vault/.pid"

    "template" = {
      "contents" = "demo/secret"
      "destination" = "/vault/secrets/demo"
    }

    "vault" = {
      "address" = "http://vault:8200"
    }
  config-init.hcl: |
    "auto_auth" = {
      "method" = {
        "config" = {
          "role" = "demo"
        }
        "type" = "kubernetes"
      }

      "sink" = {
        "config" = {
          "path" = "/vault/.token"
        }

        "type" = "file"
      }
    }

    "exit_after_auth" = true
    "pid_file" = "/vault/.pid"

    "template" = {
      "contents" = "{{ secret "demo/secret" }}"
      "destination" = "/vault/secrets/demo"
    }

    "vault" = {
      "address" = "http://vault:8200"
    }

I also get the same error when doing something like this:

{{- with secret "demo/secret" -}}{{ .Data.key }}{{- end }}

Any suggestions ?

[jasonodonnell]

You can find some examples here: https://www.vaultproject.io/docs/platform/k8s/injector/examples.html#vault-agent-injector-examples.

The error is happening because of this: "contents" = "demo/secret" in your config.hcl

Both contents (config.hcl and config-init.hcl) should be:

{{- with secret "demo/secret" -}}{{ .Data.key }}{{- end }}

[paulrostorp]

@jasonodonnell My bad that was a mistake when replacing my secrets names with demo. That is the configuration I had. The error is still occurring...
Also the example doesn't work.

[phi2039]

I encountered the same issue. The inner double-quotes must be escaped if contained in a string literal:

"template" = {
      "contents" = "{{- with secret \"demo/secret\" -}}{{ .Data.key }}{{- end }}"
      "destination" = "/vault/secrets/demo"
}

(...and it wouldn't hurt to check if you also fat-fingered and put the template inside the 'auto_auth' stanza like I did 😀 )

[semihural]

Hi.. I had the similar issue.. /vault/configs/config-init.hcl: At 23:28: illegal char... how can I fix this ?

apiVersion: v1
kind: ConfigMap
metadata:
  name: docuplatform-backend-configmap
data:
  config.hcl: |
    "auto_auth" = {
      "method" = {
        "config" = {
          "role" = "docuplatform-backend"
        }
        "type" = "kubernetes"
      }
      "sink" = {
        "config" = {
          "path" = "/home/vault/.token"
        }
        "type" = "file"
      }
    }
    "exit_after_auth" = false
    "pid_file" = "/home/vault/.pid"
    "template" = {
      "contents" = "{{`{{- with secret \"secret/data/docuplatform-backend\" -}}
        "auth_client_id_stage" : "{{ .Data.auth_client_id_stage }}",
        "auth_client_id_testing" : "{{ .Data.auth_client_id_testing }}"
      {{- end }}`}}"
      "destination" = "/vault/secrets/docuplatform-backend"
    }
    "vault" = {
      "address" = "https://vault.vault.svc.cluster.local:8200"
    }
  config-init.hcl: |
    "auto_auth" = {
      "method" = {
        "config" = {
          "role" = "docuplatform-backend"
        }
        "type" = "kubernetes"
      }
      "sink" = {
        "config" = {
          "path" = "/home/vault/.token"
        }
        "type" = "file"
      }
    }
    "exit_after_auth" = true
    "pid_file" = "/home/vault/.pid"
    "template" = {
      "contents" = "{{`{{- with secret \"secret/data/docuplatform-backend\" -}}
        "auth_client_id_stage" : "{{ .Data.auth_client_id_stage }}",
        "auth_client_id_testing" : "{{ .Data.auth_client_id_testing }}"
      {{- end }}`}}"
      "destination" = "/vault/secrets/docuplatform-backend"
    }
    "vault" = {
      "address" = "https://vault.vault.svc.cluster.local:8200"
    }