AddDaprSecretStore() fails on Kubernetes
- Dominant language
- C#
- Stars
- 1.2k
- Forks
- 378
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 6
Description
Not sure if anyone else has seen this, but on a new kubernetes enviro with dapr 1.13.2 seeing a problem with AddDaprSecretStore(). Did not see this in local development only once deployed to kubernetes.
## Expected Behavior
AddDaprSecretStore() should load secrets into the configuration
## Actual Behavior
AddDaprSecretStore() on kubernetes throws an exception and fails, no secrets loaded
## Steps to Reproduce the Problem
On a kubernetes enviro have a secret store setup and call AddDaprSecretStore(). No problems in the local environment. Also on kubernetes the daprClient.GetSecretAsync() call works correctly for the same secret store
Seems to be permission/account related with the bulk secret call. See error below
2024-04-23T02:02:31 -- Attempting to AddDaprSecretStore
2024-04-23T02:02:31 -- DAPR exception Bulk secret operation failed: the Dapr endpoint indicated a failure. See InnerException for details.
2024-04-23T02:02:31 -- DAPR exception Bulk secret operation failed: the Dapr endpoint indicated a failure. See InnerException for details. Inner: Status(StatusCode="Internal", Detail="failed getting secrets from secret store testsecretstore: secrets is forbidden: User "system:serviceaccount:default:default" cannot list resource "secrets" in API group "" in the namespace "default"")
Contributor guide
Research direction
Start with AddDaprSecretStore() and compare its bulk-secret path with the working daprClient.GetSecretAsync() call. Reproduce on Kubernetes with Dapr 1.13.2 and the default service account, then inspect the reported permission failure for listing secrets. Done means secrets load through AddDaprSecretStore() without the exception in the stated environment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, kubernetes
- Domain
- backend, infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100