vault Misleading --help message and examples for vault read and vault write

Misleading --help message and examples for vault read and vault write

Open prologic opened this issue 2 years ago • 4 comments

Describe the bug

The --help output for the vault read and vault write sub-commands are a bit misleading.

For example

$ vault write --help 2>&1 | head -n 20
Usage: vault write [options] PATH [DATA K=V...]

  Writes data to Vault at the given path. The data can be credentials, secrets,
  configuration, or arbitrary data. The specific behavior of this command is
  determined at the thing mounted at the path.

  Data is specified as "key=value" pairs. If the value begins with an "@", then
  it is loaded from a file. If the value is "-", Vault will read the value from
  stdin.

  Persist data in the generic secrets engine:

      $ vault write secret/my-secret foo=bar
...

if you were to follow this as printed:

/ # vault write secrets/my-secret foo=bar
Error writing data to secrets/my-secret: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/secrets/my-secret
Code: 404. Errors:

* no handler for route "secrets/my-secret". route entry not found.

A better example would be to match the website documentation where it clearly states as an example:

$ vault write cubbyhole/my-secret foo=bar
Success! Data written to: cubbyhole/my-secret

Environment:

Version: Vault v1.12.0-dev1
OS / Env: Docker

Vault server configuration:

ui            = true
storage "raft" {
  path       = "/vault/file"
  node_id    = "dm1.mills.io"
  retry_join {
    auto_join             = "provider=dns query=tasks.vault. server=127.0.0.11"
    auto_join_scheme      = "http"
  }
}
api_addr     = "http://{{ GetInterfaceIP \"eth1\" }}:8200" cluster_addr = "http://{{ GetInterfaceIP \"eth1\" }}:8201"
listener "tcp" {
  address         = "0.0.0.0:8200"
  cluster_address = "0.0.0.0:8201"
  tls_disable     = true
}