Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chained/nested templates #1981

Open
Himura2la opened this issue Aug 29, 2024 · 1 comment
Open

Chained/nested templates #1981

Himura2la opened this issue Aug 29, 2024 · 1 comment

Comments

@Himura2la
Copy link

Himura2la commented Aug 29, 2024

Use-cases

We are working on a configs/secrets convention in the Nomad+Consul+Vault stack, and we would like to have the following features:

  • Hot reload for config (don't store production configs in the repo/image).
  • Store secrets separate from config values (in Vault).
  • Don't store each config value separately, as there are too many config values.
  • Don't put full config into Vault.

Attempted Solutions

We found that the ideal solution would be a nested template. We'd like to store the config template in Consul K/V, like this:

{
  "foo": "bar",
  "secret" : "{{with secret "secret/data/nomad/nested-template-test-secrets"}}{{.Data.data.secret}}{{end}}"
}

Fetch it from Consul and use as a template again to resolve Vaulted values, like this:

job "nested-template-test" {
  datacenters = ["dc"]
  group "nested-template-test" {
    task "nested-template-test" {
      driver = "docker"
      config {
        image = "alpine"
        interactive = true
      }

      template {
        data = <<-EOF
          {{key "nested-template-test-config"}}
        EOF
        destination = "local/from-consul.json.tmpl"
      }
      template {
        source = "local/from-consul.json.tmpl"
        destination = "secrets/from-vault.json"
      }

    }
  }
}

Proposal

Unfortunately, this does not work, looks like Nomad checks all template sources before starting to execute templates.

 template: failed to read template: exit status 1: failed to open source file "/nested-template-test/local/from-consul.json.tmpl": open /nested-template-test/local/from-consul.json.tmpl: no such file or directory 

Maybe someone have something else to propose, which may suite our needs...

@Himura2la Himura2la changed the title Nested templates Chained/nested templates Aug 29, 2024
@tgross
Copy link
Member

tgross commented Sep 3, 2024

Hi @Himura2la! You're right this isn't currently possible. This would be a feature that would need to be added to consul-template, so I'll move this issue there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants