Skip to content

[BUG] PKI certificate retrieval fails if pki backend does not provide ca_chain #609

@mxab

Description

@mxab

Vault server version

v1.4

vault-action version

v2.0.0

Describe the bug

PKI certificate fails after retrieval when no ca_chain is present.

I can see the action is retrieving the certificate (prints the fingerprint) but then fails in the action when its processed: Error: Cannot read properties of undefined (reading 'join')

Vault API marks the ca_chain property as optional.

"ca_chain": {
	Type:        framework.TypeCommaStringSlice,
	Description: `Certificate Chain`,
	Required:    false,
},

https://github.com/hashicorp/vault/blob/0bebe0058ddd6601dcf5aaff6baf2092f076f9db/builtin/logical/pki/path_issue_sign.go#L73-L77

The vault-action assumes it is always there as it iterates of the outputMap without checking that the ca_chain fields is actually present.
Then the ca_chain concatenation part fails

To Reproduce

The yaml of the vault-action step, with any sensitive information masked or removed.

      - name: Setup Nomad TLS Environment Variables
        id: nomad-tls
        uses: hashicorp/vault-action@v4.0.0
        with:
          url: "...."
          method: approle
          path: "..."
          roleId: ${{  }}
          secretId: ${{  }}
          # this does not provide a ca_chain property
          pki: | 
            my-tls-path/issue/cli {"common_name": "cli", "ttl": "10m"} ;  

Expected behavior

It should create the tls parts and not fail

Log Output

....
Token Info
::add-mask::***
✔ Successfully generated certificate (serial number <redacted>)
::endgroup::

Error: Cannot read properties of undefined (reading 'join')

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions