Vault secret not pulled properly: "secrets may not be converted into strings"

Grafana Alloy
, ,
1

Hey,

I’m trying to integrate Alloy with my hashicorp Vault cluster and unfortunately my Alloy pods are not starting due to the following error:

Error: /etc/alloy/config.alloy:15:18: remote.vault.cluster.data.LOKI_USER secrets may not be converted into strings

Here is my config file:

remote.vault "cluster" {
  server = "https://vault-cluster.default:8200"
  path = "default"
  key = "loki/secret"
  auth.kubernetes {
    role = "alloy"
  }
}

loki.write "loki_endpoint" {
  endpoint {
    url = "https://loki.default:3100"
    basic_auth {
       username = remote.vault.cluster.data.LOKI_USER
       password = remote.vault.cluster.data.LOKI_PASSWORD
    }
  }
}

I’m not entirely sure what’s wrong here, the secrets in vault are in string form. I’m on Alloy 1.8.2 version. Did anyone stumble upon this issue?

2

Solved. Just in case someone encounters the same issue - Loki component expects url and basic_auth.username to not be secrets so they need to be wrapped in convert.nonsensitive(). Loki component documentation clearly states this, I just missed it.

1 Like