0

I am making a template for postgres-exporter and encountered such question. Is it possible to use two or more paths to secrets in the "with secret" section? For example {{ with secret "TEST/A/TEST/DEV_COMMON1" "TEST/A/TEST/DEV_COMMON2"}}? In this configuration, Sidecar only reads the last instruction:

vault.hashicorp.com/agent-inject-template-pgsource: |
{{- range .Values.secman.secrets }}
     {{`{{ with secret `}}{{ .path | quote }}{{` }}`}}
{{- end }}
     #!/bin/sh
     {{- $dns := list -}}
     {{- range $db := $.Values.database -}}
     {{ $dns = append $dns (printf "postgresql://%s:{{ .Data.%s }}@%s:%s/%s?sslmode=%s" $db.user $db.pass $db.hostName $db.port $db.dbSchema $db.sslmode) }}
     {{ end -}}
     {{`export DATA_SOURCE_NAME=`}}{{ join "," $dns | quote }}
{{- range .Values.secman.secrets }}
     {{`{{- end }}`}}
{{- end }}

After templating:

        vault.hashicorp.com/agent-inject-template-pgsource: >
          {{ with secret "TEST/A/TEST/DEV_COMMON1" }}

          {{ with secret "TEST/A/TEST/DEV_COMMON2" }}

          #!/bin/sh


          export DATA_SOURCE_NAME="postgresql://user1:{{
          .Data.pass1
          }}@host1:5433/postgres?sslmode=disable,postgresql://user2:{{
          .Data.pass2
          }}@host2:5433/postgres?sslmode=disable"

          {{- end }}

          {{- end }}

If I open the pgsource file, I see there "no value":

#!/bin/sh
export DATA_SOURCE_NAME="postgresql://user1:<no value>@host1:5433/postgres?sslmode=disable,postgresql://user2:pass2@host2:5433/postgres?sslmode=disable"

Is it possible for pass1 to be substituted from one tenant and pass2 from another? Thanks!

Community
  • 1
  • 1
Cvitoybamp
  • 21
  • 4

0 Answers0