如何在 envconsul 配置文件中传递环境变量？答案

【问题标题】：How to pass environmental variables in envconsul config file?如何在 envconsul 配置文件中传递环境变量？
【发布时间】：2019-07-24 08:23:34
【问题描述】：

我在envconsul documentation读到这个：

为了提高安全性，也可以从环境中读取令牌使用 CONSUL_TOKEN 或 VAULT_TOKEN 环境变量分别。强烈建议您不要放置代币配置文件中的纯文本格式。

所以，我有这个envconsul.hcl 文件：

# the settings to connect to vault server
# "http://10.0.2.2:8200" is the Vault's address on the host machine when using Minikube
vault {
  address = "${env(VAULT_ADDR)}"
  renew_token = false
  retry {
    backoff = "1s"
  }
  token = "${env(VAULT_TOKEN)}"
}
# the settings to find the endpoint of the secrets engine
secret {
    no_prefix = true
    path = "secret/app/config"
}

但是，我收到此错误：

[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Get $%7Benv%28VAULT_ADDR%29%7D/v1/secret/app/config: unsupported protocol scheme "" (retry attempt 1 after "1s")

据我了解，它不能进行变量替换。
我尝试设置"http://10.0.2.2:8200"，它可以工作。

VAULT_TOKEN 变量也是如此。
如果我对VAULT_ADDR 进行硬编码，则会收到此错误：

[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Error making API request.

URL: GET http://10.0.2.2:8200/v1/secret/app/config
Code: 403. Errors:

* permission denied (retry attempt 2 after "2s")

有没有办法让这个文件理解环境变量？

编辑 1 这是我的pod.yml 文件

---
apiVersion: v1
kind: Pod
metadata:
  name: sample
spec:
  serviceAccountName: vault-auth

  restartPolicy: Never

  # Add the ConfigMap as a volume to the Pod
  volumes:
    - name: vault-token
      emptyDir:
        medium: Memory
    # Populate the volume with config map data
    - name: config
      configMap:
        # `name` here must match the name 
        # specified in the ConfigMap's YAML
        # -> kubectl create configmap vault-cm --from-file=./vault-configs/
        name: vault-cm
        items:
          - key : vault-agent-config.hcl
            path: vault-agent-config.hcl
          - key : envconsul.hcl
            path: envconsul.hcl

  initContainers:
    # Vault container
    - name: vault-agent-auth
      image: vault

      volumeMounts:
        - name: vault-token
          mountPath: /home/vault
        - name: config
          mountPath: /etc/vault

      # This assumes Vault running on local host and K8s running in Minikube using VirtualBox
      env:
        - name: VAULT_ADDR
          value: http://10.0.2.2:8200

      # Run the Vault agent
      args:
        [
          "agent",
          "-config=/etc/vault/vault-agent-config.hcl",
          "-log-level=debug",
        ]

  containers:
    - name: python
      image: myappimg
      imagePullPolicy: Never
      ports:
        - containerPort: 5000
      volumeMounts:
        - name: vault-token
          mountPath: /home/vault
        - name: config
          mountPath: /etc/envconsul
      env:
        - name: HOME
          value: /home/vault
        - name: VAULT_ADDR
          value: http://10.0.2.2:8200

【问题讨论】：

您是如何在 kubernetes 中部署该 pod 的？可以分享一下 yaml 规范吗？

标签： kubernetes minikube consul hashicorp-vault

【解决方案1】：

我。在容器规范中设置环境变量（双引号中的值）：

env:
  - name: VAULT_TOKEN
    value: "abcd1234"
  - name: VAULT_ADDR
    value: "http://10.0.2.2:8200"

然后参考envconsul.hcl中的值

vault {
  address = ${VAULT_ADDR}
  renew_token = false
  retry {
    backoff = "1s"
  }
  token = ${VAULT_TOKEN}
}

二。另一种选择是解封保管库集群（使用初始化保管库集群时打印的解封密钥）

$ vault operator unseal

然后使用根令牌向保管库集群进行身份验证。

$ vault login <your-generated-root-token>

更多details

【讨论】：

【解决方案2】：

我尝试了很多建议，但在我将 -vault-token 参数传递给 envconsul 命令之前没有任何效果，如下所示：

envconsul -vault-token=$VAULT_TOKEN -config=/app/config.hcl -secret="/secret/debug/service" env

在 config.hcl 中应该是这样的：

 vault {
  address     = "http://kvstorage.try.direct:8200"
  token       = "${env(VAULT_TOKEN)}"
 }

【讨论】：