Skip to content

Refresh Vault token from disk on each Consult.load call#57

Open
nogazr wants to merge 1 commit intomasterfrom
fix-rendering-error
Open

Refresh Vault token from disk on each Consult.load call#57
nogazr wants to merge 1 commit intomasterfrom
fix-rendering-error

Conversation

@nogazr
Copy link
Copy Markdown
Contributor

@nogazr nogazr commented Apr 22, 2026

The Vault Ruby gem caches the token in memory at client initialization and never re-reads. The token is being renewed and written to a shared volume (symlinked to ~/.vault-token), but the running Rails process keeps using the stale cached token. This causes 403 "invalid token" errors when templates are re-rendered at runtime.

Adding c.token = Vault::Defaults.token to configure_vault forces the client to re-read the token from ~/.vault-token on every Consult.load call, picking up vault-agent's renewed token.

Test Plan

1. Start a console session

bin/console

2. Load config and remove the explicit token

Consult.load config_dir: 'spec/support'
Consult.config[:vault].delete(:token)

This simulates a production consult.yml key, relying on a local token agent instead.

3. Write a first token to disk

echo 'first-token' > ~/.vault-token

4. Call configure_vault and verify

Consult.configure_vault
Vault.client.token # => "first-token"

5. Simulate a token rotation

In a separate terminal:

echo 'second-token' > ~/.vault-token

6. Call configure_vault again and confirm the new token is picked up

Consult.configure_vault
Vault.client.token # => "second-token"

7. Restore your real Vault token when done

vcli init --force

@nogazr nogazr self-assigned this Apr 22, 2026
@nogazr nogazr force-pushed the fix-rendering-error branch 2 times, most recently from d67cbe1 to f2de018 Compare April 22, 2026 21:30
@nogazr nogazr marked this pull request as ready for review April 22, 2026 22:23
@nogazr nogazr requested a review from a team as a code owner April 22, 2026 22:23
@nogazr nogazr force-pushed the fix-rendering-error branch from f2de018 to 3803261 Compare April 22, 2026 22:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant