"patch" a kv2?

[tony-kerz]

Terraform Version

0.14.7

Affected Resource(s)

• vault_generic_secret
• vault_generic_endpoint

Terraform Configuration Files

i have two situations where i'm looking for kv2-patch behavior,
to avoid clobbering some portion of a secret:

(a) two different areas of code are both wanting to write to the same path
(b) a human and some code are both wanting to write to the same path

i've tried both vault-generic-secret and vault-generic-endpoint and they both seem to be clobbering whatever was there,
is there some magic either of these behave like patch?

Expected Behavior

would love to see patch behavior

Actual Behavior

every write overwrites previous values

Steps to Reproduce

hand write something in vault, try to patch it using either of the two resources mentioned above

Important Factoids

kv2 in play

[MAN98]

hi @tony-kerz - I had the same scenario. What I have as a workaround for this is I use the data source for "vault_generic_secret" to get the current data value then merge with the KV pair I want to add/patch. Hope the code snippet below helps:

data "vault_generic_secret" "mysecret" {
  path = "secret/mysecret"
}

resource "vault_generic_secret" "merge_new_kvpair" {
  path = "secret/mysecret"

  data_json = jsonencode(merge(data.vault_generic_secret.mysecret.data, { "NewKey" = "NewValue" }))
}

[tony-kerz]

@MAN98 yes, i tried the same thing, and it works ok, but an issue that i forgot to mention is that like data, even patch only works if the secret is already there. i have some groovy code that looks like this to effect an "upsert":

  def status = sh script: "vault kv get ${_path}", returnStatus: true
  if (status) {
    // assume path does-not exist so use put
    //
    sh "vault kv put ${_path} ${toks.last()}=${value}"
  } else {
    // assume path does exist so use patch
    //
    sh "vault kv patch ${_path} ${toks.last()}=${value}"
  }

what would be awesome would be building something like the above into the provider which could be activated with an "upsert" option flag 😎

[gcoupelant]

I have the same issue, I had to create a external data source with a small bash script to check if a secret exists first.
That would be nice if the vault_generic_secret data had some default value if the secret doesn't exist.

[edupo]

Are there any news about this?

[umutzd]

i needed to create kvv2 secrets in bulk through terraform without creating new versions everytime terraform gets invoked and it's interesting to have a resource like this: what is the point of terraform state if it generates a new version of the secret everytime we run terraform apply? when you use kvv2, everytime you invoke terraform, it applies a modification.

seems like kvv2 can't be automated through terraform directly (for people who use atlantis to apply terraform)