Vault server version
v1.4
vault-action version
v2.0.0
Describe the bug
PKI certificate fails after retrieval when no ca_chain is present.
I can see the action is retrieving the certificate (prints the fingerprint) but then fails in the action when its processed: Error: Cannot read properties of undefined (reading 'join')
Vault API marks the ca_chain property as optional.
"ca_chain": {
Type: framework.TypeCommaStringSlice,
Description: `Certificate Chain`,
Required: false,
},
https://github.com/hashicorp/vault/blob/0bebe0058ddd6601dcf5aaff6baf2092f076f9db/builtin/logical/pki/path_issue_sign.go#L73-L77
The vault-action assumes it is always there as it iterates of the outputMap without checking that the ca_chain fields is actually present.
Then the ca_chain concatenation part fails
To Reproduce
The yaml of the vault-action step, with any sensitive information masked or removed.
- name: Setup Nomad TLS Environment Variables
id: nomad-tls
uses: hashicorp/vault-action@v4.0.0
with:
url: "...."
method: approle
path: "..."
roleId: ${{ }}
secretId: ${{ }}
# this does not provide a ca_chain property
pki: |
my-tls-path/issue/cli {"common_name": "cli", "ttl": "10m"} ;
Expected behavior
It should create the tls parts and not fail
Log Output
....
Token Info
::add-mask::***
✔ Successfully generated certificate (serial number <redacted>)
::endgroup::
Error: Cannot read properties of undefined (reading 'join')
Vault server version
v1.4
vault-action version
v2.0.0
Describe the bug
PKI certificate fails after retrieval when no
ca_chainis present.I can see the action is retrieving the certificate (prints the fingerprint) but then fails in the action when its processed:
Error: Cannot read properties of undefined (reading 'join')Vault API marks the
ca_chainproperty as optional.https://github.com/hashicorp/vault/blob/0bebe0058ddd6601dcf5aaff6baf2092f076f9db/builtin/logical/pki/path_issue_sign.go#L73-L77
The vault-action assumes it is always there as it iterates of the
outputMapwithout checking that theca_chainfields is actually present.Then the
ca_chainconcatenation part failsTo Reproduce
The yaml of the
vault-actionstep, with any sensitive information masked or removed.Expected behavior
It should create the tls parts and not fail
Log Output