Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vault agent memory leak when template can't write to file #28876

Open
sgorbaty opened this issue Nov 11, 2024 · 0 comments
Open

Vault agent memory leak when template can't write to file #28876

sgorbaty opened this issue Nov 11, 2024 · 0 comments
Labels

Comments

@sgorbaty
Copy link

Describe the bug

Unbounded memory growth when DAC unix permissions prevent file to be written to disk.
image

Noticeable CPU usage growth:
image

To Reproduce
Steps to reproduce the behavior:

  1. Configure vault agent with
 "template": [
    {
      "source": "/etc/vault_agent/vault.ctmpl",
      "destination": "/etc/vault_agent/certificate.pem",
      "perms": "0640",
      "error_on_missing_key": true
    }
  ],
  1. vault.ctmpl is this:
{{- with pkiCert "pki/internal_certs/issue/site-ec" "common_name=***-***.internal.net" -}}
{{ .Cert }}{{ .CA }}
{{ if .Key }}
  {{ .Key | writeToFile "/etc/vault_agent/private_key.pem" "" "" "0600" }}
{{ end }}
{{- end -}}
  1. /etc/vault_agent/private_key.pem is actually configured as chmod 0400.

Expected behavior
Failure to write to disk and no memory leak or CPU spike.

Environment:

  • Vault Server Version (retrieve with vault status):
    Vault v1.17.5
  • Vault CLI Version (retrieve with vault version):
    Vault v1.17.5
  • Server Operating System/Architecture:
    unix

Vault server configuration file(s):

# renew/rotate the cert for associated ica
path "pki/${function}/issue/${pkirole}" {
  capabilities = ["create", "update"]
}

Additional context
Error:

execute: template: :4:12: executing \"\" at <writeToFile \"/etc/vault_agent/private_key.pem\" \"\" \"\" \"0600\">: error calling writeToFile: open /etc/vault_agent/private_key.pem: permission denied"
@kubawi kubawi added the agent label Nov 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants