dapr / dapr/dotnet-sdk

AddDaprSecretStore() fails on Kubernetes

Open
#1,275 1 comment 0 reactions 0 assignees View on GitHub
area/client/secrets kind/bug
Dominant language
C#
Stars
1.2k
Forks
378
Avg merge
2d 1h
Merged PRs (30d)
6

Description

Not sure if anyone else has seen this, but on a new kubernetes enviro with dapr 1.13.2 seeing a problem with AddDaprSecretStore(). Did not see this in local development only once deployed to kubernetes.

## Expected Behavior

AddDaprSecretStore() should load secrets into the configuration

## Actual Behavior

AddDaprSecretStore() on kubernetes throws an exception and fails, no secrets loaded

## Steps to Reproduce the Problem
On a kubernetes enviro have a secret store setup and call AddDaprSecretStore(). No problems in the local environment. Also on kubernetes the daprClient.GetSecretAsync() call works correctly for the same secret store

Seems to be permission/account related with the bulk secret call. See error below

2024-04-23T02:02:31 -- Attempting to AddDaprSecretStore
2024-04-23T02:02:31 -- DAPR exception Bulk secret operation failed: the Dapr endpoint indicated a failure. See InnerException for details.
2024-04-23T02:02:31 -- DAPR exception Bulk secret operation failed: the Dapr endpoint indicated a failure. See InnerException for details. Inner: Status(StatusCode="Internal", Detail="failed getting secrets from secret store testsecretstore: secrets is forbidden: User "system:serviceaccount:default:default" cannot list resource "secrets" in API group "" in the namespace "default"")

Contributor guide

Open the contributing guide

Research direction

Start with AddDaprSecretStore() and compare its bulk-secret path with the working daprClient.GetSecretAsync() call. Reproduce on Kubernetes with Dapr 1.13.2 and the default service account, then inspect the reported permission failure for listing secrets. Done means secrets load through AddDaprSecretStore() without the exception in the stated environment.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, kubernetes
Domain
backend, infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.