[BUG] Vault command errors configured locally

[jtraub91]

Description
When configuring vault for use with a masterless command, e.g. salt-call --local, I am getting an error when running vault.read_secret.

Setup
minion.d/vault.conf

vault:
  url: sdb://yaml/vault_url
  verify: False
  auth:
    method: approle
    role_id: sdb://yaml/role_id
    secret_id: sdb://yaml/secret_id
  policies:
    - saltstack/minions
    - saltstack/minions/{minion}

minion.d/sdb.conf

yaml:
  driver: yaml
  files:
    - /etc/salt/vault_token.yaml

/etc/salt/vault_token.yaml

vault_url: https://x.x.x.x:yyyy
role_id: xxxxxxx
secret_id: xxxxxxx

Steps to Reproduce the behavior

salt-call --local vault.read_secret <path> <key>

Expected behavior
Should return the value of the <key> at <path>. Instead I am getting the following error:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/salt/modules/vault.py", line 209, in read_secret
    response = __utils__["vault.make_request"]("GET", url)
  File "/usr/lib/python3.6/site-packages/salt/utils/vault.py", line 342, in make_request
    connection["uses"] -= 1
KeyError: 'uses'

Versions Report

Salt Version:
           Salt: 3001.1

Dependency Versions:
           cffi: 1.14.1
       cherrypy: Not Installed
       dateutil: Not Installed
      docker-py: 4.2.0
          gitdb: Not Installed
      gitpython: Not Installed
         Jinja2: 2.11.2
        libgit2: Not Installed
       M2Crypto: 0.35.2
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.6.2
   mysql-python: Not Installed
      pycparser: 2.20
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 3.6.8 (default, Apr  2 2020, 13:34:55)
   python-gnupg: Not Installed
         PyYAML: 5.3.1
          PyZMQ: 19.0.1
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.2

System Versions:
           dist: centos 7 Core
         locale: UTF-8
        machine: x86_64
        release: 3.10.0-1127.el7.x86_64
         system: Linux
        version: CentOS Linux 7 Core

[jtraub91]

FYI I can avoid the error by commenting out this section: https://github.com/saltstack/salt/blob/v3001.1/salt/utils/vault.py#L336-L352, but there ought to be a more proper solution for this.

[beornf]

Also this line wrongly makes an assumption that all Vault approle tokens expire in exactly 1 hour https://github.com/saltstack/salt/blob/v3001.1/salt/utils/vault.py#L157.

[danielrobbins]

This issue has been approved to be addressed in a future version of salt.

[JeremyHutchings]

@jtraub91 Could you get any connection with vault working at all, even with a master ?