Issue with Bash Commands in Alpine Images Using ‘hashicorp/vault:lates

GitLab CI/CD
, , ,
1

Description:

Hello GitLab community,

I’m encountering an issue while trying to use Bash commands within Alpine images, specifically when using the hashicorp/vault:latest image. My script is as follows:

stages:
  - read-secrets

variables:
  VAULT_SECRETS: "kv/app/prod:appprod-password,kv/db/prod:dbprod-password"

.authenticate:
  tags:
    - docker
  image: hashicorp/vault:latest
  id_tokens:
    VAULT_AUTH_TOKEN:
      aud: $VAULT_ADDR
  script:
    - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=$VAULT_AUTH_ROLE jwt=$VAULT_AUTH_TOKEN)"
    - |
      IFS=',' read -ra secrets <<< "$VAULT_SECRETS"
      for secret_info in "${secrets[@]}"; do
        IFS=':' read -r secret_path secret_field <<< "$secret_info"
        echo "Fetching secret for path $secret_path and field $secret_field"
        secret_value="$(vault kv get -field="$secret_field" "$secret_path")"
        echo "Fetched secret value $secret_value"
        export "SECRET_${secret_field^^}"="$secret_value"
      done

read-secrets:
  stage: read-secrets
  extends: .authenticate

The issue arises when attempting to use the Internal Field Separator (IFS) within the hashicorp/vault:latest image. Unfortunately, it seems that IFS is not functioning as expected.

If anyone has encountered a similar problem or has suggestions for resolving this issue, I would greatly appreciate your insights.

Thank you in advance for your assistance!

2

AFAIK alpine based images do not provide support for bash as shell, and require to install bash manually.

Something along the lines of the following, untested.

  - apk update
  - apk add bash
  - bash
  - <more code>
3 Likes
3

Thanks @dnsmichi. I used awk instead of IFS in my script, and it worked in Alpine images. Below is the code for reference for anyone who encounters the same issue.

    - |
      for secret_info in $VAULT_SECRETS; do
        secret_path=$(echo "$secret_info" | awk -F ':' '{print $1}')
        secret_field=$(echo "$secret_info" | awk -F ':' '{print $2}')
        echo "Fetching secret for: $secret_info"
        echo "Fetching secret value for path $secret_path and field $secret_field"
        vault kv get -field="$secret_field" "$secret_path"
      done
2 Likes