Describe the bug
When running vault-agent auto-auth and using the file sink method, the mode option does not work as expected. Permissions are octal (base-8) but the mode field in the configuration for the file sink is parsed as an integer (base-10). This leads to a lot of confusion and unexpected behavior with permissions for the sink file that is created.
I suggest the mode field be parsed as a JSON string instead of a JSON integer and validation about it being a valid octal permission be done afterwards.
To Reproduce
- Install vault agent with an auto-auth configuration as follows:
{
"pid_file": "./pidfile",
"exit_after_auth": false,
"vault": {
"address": "https://<vault-address-here>:8200"
},
"auto_auth": {
"method": {
"type": "approle",
"config": {
"role_id_file_path": "/tmp/.roleid",
"secret_id_file_path": "/tmp/.secretid",
}
},
"sink": [
{
"type": "file",
"config": {
"path": "/tmp/.vault-token",
"mode": 640
}
}
]
}
Provide an approle role_id and secret_id at the appropriate locations
- Start the vault-agent service.
- Look at the permissions for the
/tmp/.vault-token file and see that they are incorrect
[root@75856f20-e289-4 ~]# stat -c "%a" /tmp/.vault-token
200
640 base-10 is 1200 in octal which when applied to a file results in 200 unix permissions.
If I enter the base-10 equivalent of the 640 octal number which is 416 into the configuration, I get the expected unix file permissions.
Expected behavior
I expected the permissions of the file-sink file to be the octal mode I entered in the configuration.
Environment:
- Vault Server Version: 1.3.2 (the one the agent is connecting to)
- Vault Agent Version: 1.4.2
- Server Operating System/Architecture: RHEL7
Describe the bug
When running vault-agent auto-auth and using the file sink method, the mode option does not work as expected. Permissions are octal (base-8) but the mode field in the configuration for the file sink is parsed as an integer (base-10). This leads to a lot of confusion and unexpected behavior with permissions for the sink file that is created.
I suggest the mode field be parsed as a JSON string instead of a JSON integer and validation about it being a valid octal permission be done afterwards.
To Reproduce
{ "pid_file": "./pidfile", "exit_after_auth": false, "vault": { "address": "https://<vault-address-here>:8200" }, "auto_auth": { "method": { "type": "approle", "config": { "role_id_file_path": "/tmp/.roleid", "secret_id_file_path": "/tmp/.secretid", } }, "sink": [ { "type": "file", "config": { "path": "/tmp/.vault-token", "mode": 640 } } ] }Provide an approle role_id and secret_id at the appropriate locations
/tmp/.vault-tokenfile and see that they are incorrect640 base-10 is 1200 in octal which when applied to a file results in 200 unix permissions.
If I enter the base-10 equivalent of the 640 octal number which is 416 into the configuration, I get the expected unix file permissions.
Expected behavior
I expected the permissions of the file-sink file to be the octal mode I entered in the configuration.
Environment: