PowerShell调用Docker执行HashiCorp Vault命令报错问题排查与解决

这是我职业生涯中遇到的最诡异的问题之一：

我编写了如下PowerShell代码：

$string="$($VAULT_SETTINGS.SECRETS_ENGINE_PATH)/$($VAULT_SETTINGS.SECRETS_SOLUTION_NAME)/Database__ConnectionString default=`"Server=$($DB_SETTINGS.SERVICE_NAME);Initial Catalog=$($DB_SETTINGS.InitialCatalog);User=$($DB_SETTINGS.DbUser);Password=$($DB_SETTINGS.DbPassword);MultipleActiveResultSets=True;Application Name=$($DB_SETTINGS.APPLICATION_NAME);Encrypt=True;Connection Timeout=180`""
docker exec $($VAULT_SETTINGS.SERVICE_NAME) vault kv put $string
 
$string="$($VAULT_SETTINGS.SECRETS_ENGINE_PATH)/$($VAULT_SETTINGS.SECRETS_SOLUTION_NAME)/Database__ConnectivityConnectionString default=`"Server=$($DB_SETTINGS.SERVICE_NAME);User=$($DB_SETTINGS.DbUser);Password=$($DB_SETTINGS.DbPassword);MultipleActiveResultSets=True;Application Name=$($DB_SETTINGS.APPLICATION_NAME);Encrypt=True;Connection Timeout=180`""
docker exec $($VAULT_SETTINGS.SERVICE_NAME) vault kv put $string

所有变量均为字母数字格式，无空格或特殊符号。运行环境为完全更新的Windows 11，使用最新版HashiCorp Vault与Docker 20.10.17。

最初以为第一条命令执行正常（后发现同样异常），第二条命令返回500错误。经过一下午排查发现，若在第二条命令的连接字符串中给User或Password添加空格（如Us er），命令即可正常执行。但如果通过Write-Host输出命令并复制粘贴执行，两条命令均能正常运行。

解决方案 #

耗时4小时排查后发现，原写法会导致HashiCorp Vault将请求按第一个分号拆分为两个键值对，两条命令均存在问题。正确写法如下：

$string="Server=$($DB_SETTINGS.SERVICE_NAME);User=$($DB_SETTINGS.DbUser);Password=$($DB_SETTINGS.DbPassword);MultipleActiveResultSets=True;Application Name=$($DB_SETTINGS.APPLICATION_NAME);Encrypt=True;Connection Timeout=180"
docker exec $($VAULT_SETTINGS.SERVICE_NAME) vault kv put "$($VAULT_SETTINGS.SECRETS_ENGINE_PATH)/$($VAULT_SETTINGS.SECRETS_SOLUTION_NAME)/Database__ConnectivityConnectionString" default="$string"

目前问题已解决，但暂不清楚为何必须给$string添加引号。

内容的提问来源于stack exchange，提问作者Shiunbird