Encrypted List in Datastore Not Validating as Array When Triggered by IntervalTimer

[Abhi5h3k]

SUMMARY

I have encountered an unexpected behavior while working with StackStorm workflows involving encrypted data stored in the datastore.

STACKSTORM VERSION

st2 3.8.1, on Python 3.8.10

OS, environment, install method

Docker

Steps to reproduce the problem

Encrypted List Storage: I have stored an encrypted list in the StackStorm datastore using the following command:

st2 key set -e host_list_1 "['host1.com','host2.com']"

My workflow meta:

pack: custom_workflow
enabled: true
runner_type: orquesta
name:  test_usage_workflow
entry_point: workflows/test_usage_workflow.yaml
description: Test usage for the given host to match a threshold
parameters:
  hosts:
    required: true
    type: array
    default: "{{ st2kv.system.host_list_1 | decrypt_kv }}"
    secret: true

Observed Behavior:

The workflow executes successfully when triggered directly from the web UI or using the command line:

st2 run custom_workflow.ram_usage_workflow

However, when the same workflow is triggered using core.st2.IntervalTimer, it fails to initiate and throws a validation error:

jsonschema.exceptions.ValidationError: '{{ st2kv.system.host_list_1 | decrypt_kv}}' is not of type 'array'

Failed validating 'type' in schema['properties']['hosts']:
    {'default': '{{ st2kv.system.host_list_1 | decrypt_kv}}',
     'required': True,
     'secret': True,
     'type': 'array'}

Expected Results

The workflow should correctly decrypt and validate the list stored in the datastore as an array, regardless of whether it is triggered directly or via core.st2.IntervalTimer.

Actual Behavior:

The workflow fails to validate the decrypted list as an array when triggered by core.st2.IntervalTimer.

Request for Assistance:

Could you please help me understand why the validation fails when triggered by core.st2.IntervalTimer and guide me on how to correctly pass a list from the datastore to the default value in my workflow parameters?

[Abhi5h3k]

I’ve recently made changes to our workflow, replacing an array with comma-separated string values. While the workflow works fine when executed from the web interface and the command line, I’ve encountered a strange issue.

st2 key set -e host_list_1 "host1.com,host2.com"

The problem arises when a rule triggers the associated action. The action fails with the following error message:

"Failed to render parameter \"passwords\": [Errno 2] No such file or directory: '/etc/st2/keys/datastore_key.json'"

However, I can personally verify that the file datastore_key.json does exist.

What’s even more peculiar is that if I re-run the same action without making any changes, it runs successfully 🤯

As I'm running stackstorm in docker container.
In st2-docker-master-st2client-1 we have datastore_key.json , I also checked rule engine container and this file is missing there. Can this be the issue?

If the issue is related to file not found, Then why is it working on re-run from history. 🤔

Any insights or suggestions on how to troubleshoot this issue would be greatly appreciated!

Note : After more analysis, It's related to keystore decryption. When we store value without encryption. Rule interval timer works fine.

[Abhi5h3k]

I was able to fix this! As suspected, it was due to the container not having access to the key store volume.

I've added a pull request to address this: Pull Request #264.