lib/hvault.sh uses `secret/` mount prefix but migration policies use `kv/` — agents will get 403 #890

New issue

Closed

opened 2026-04-16 15:51:59 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-16 15:51:59 +00:00

Collaborator

Flagged by AI reviewer in PR #888.

Problem

lib/hvault.sh functions hvault_kv_get, hvault_kv_put, and hvault_kv_list all hardcode secret/data/ and secret/metadata/ as KV v2 path prefixes (lines 117, 157, 173).

The Nomad+Vault migration (S2.1, #879) establishes kv/ as the mount name for all factory secrets — every policy in vault/policies/*.hcl grants ACL on kv/data/disinto/... paths.

If any agent calls hvault_kv_get after the migration, Vault will route the request to secret/data/... but the token only holds ACL for kv/data/..., producing a 403 Forbidden.

Fix

Change the mount prefix in hvault_kv_get, hvault_kv_put, and hvault_kv_list from secret/ to kv/, or make the mount name configurable via VAULT_KV_MOUNT (defaulting to kv). Coordinate with S2.2 (#880) which writes secrets into the kv/ mount.

Auto-created from AI review of PR #888

Affected files

lib/hvault.sh — change secret/data/ and secret/metadata/ prefixes to kv/data/ and kv/metadata/ (lines ~117, 157, 173); optionally make configurable via VAULT_KV_MOUNT

Acceptance criteria

hvault_kv_get, hvault_kv_put, hvault_kv_list use kv/ mount prefix (not secret/)
Agents can read/write KV paths that policies in vault/policies/*.hcl grant (no 403)
Optionally: VAULT_KV_MOUNT env var overrides the mount name (defaults to kv)
shellcheck clean

Flagged by AI reviewer in PR #888. ## Problem `lib/hvault.sh` functions `hvault_kv_get`, `hvault_kv_put`, and `hvault_kv_list` all hardcode `secret/data/` and `secret/metadata/` as KV v2 path prefixes (lines 117, 157, 173). The Nomad+Vault migration (S2.1, #879) establishes `kv/` as the mount name for all factory secrets — every policy in `vault/policies/*.hcl` grants ACL on `kv/data/disinto/...` paths. If any agent calls `hvault_kv_get` after the migration, Vault will route the request to `secret/data/...` but the token only holds ACL for `kv/data/...`, producing a 403 Forbidden. ## Fix Change the mount prefix in `hvault_kv_get`, `hvault_kv_put`, and `hvault_kv_list` from `secret/` to `kv/`, or make the mount name configurable via `VAULT_KV_MOUNT` (defaulting to `kv`). Coordinate with S2.2 (#880) which writes secrets into the `kv/` mount. --- *Auto-created from AI review of PR #888* ## Affected files - `lib/hvault.sh` — change `secret/data/` and `secret/metadata/` prefixes to `kv/data/` and `kv/metadata/` (lines ~117, 157, 173); optionally make configurable via `VAULT_KV_MOUNT` ## Acceptance criteria - [ ] `hvault_kv_get`, `hvault_kv_put`, `hvault_kv_list` use `kv/` mount prefix (not `secret/`) - [ ] Agents can read/write KV paths that policies in `vault/policies/*.hcl` grant (no 403) - [ ] Optionally: `VAULT_KV_MOUNT` env var overrides the mount name (defaults to `kv`) - [ ] `shellcheck` clean