hashicorp / hashicorp/vault-action

Error: failed to retrieve vault token. code: ERR_NON_2XX_3XX_RESPONSE, message: Response code 400 (Bad Request), vaultResponse: {"errors":["could not load configuration"]}[BUG]

Open
#560 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
514
Forks
166
Avg merge
6d 4h
Merged PRs (30d)
1

Description

## Vault server version
v1.16.2

## vault-action version
v3

## Describe the bug
JWT token is not working on our new vault setup and we are getting the below error

Error: failed to retrieve vault token. code: ERR_NON_2XX_3XX_RESPONSE, message: Response code 400 (Bad Request), vaultResponse: {"errors":["could not load configuration"]}[BUG]

Please find the snip of the workflow
env:
VAULT_ADDR: "https://secrets.********.net"
VAULT_NAMESPACE: "admin/*************"
VAULT_ROLE: " kpt-platform-testqa-wus3-rg_rw_role"

- name: Pull HC Vault secrets
uses: hashicorp/vault-action@v3
id: secrets
with:
method: jwt
url: ${{env.VAULT_ADDR}}
namespace: ${{env.VAULT_NAMESPACE}}
role: ${{env.VAULT_ROLE}}
secrets: |
********************/data/testqa CLIENT_ID | ARM_CLIENT_ID ;
********************/data/testqa CLIENT_SECRET | ARM_CLIENT_SECRET ;
********************/data/testqa TENANT_ID | ARM_TENANT_ID ;
********************/data/testqa SUBSCRIPTION_ID | ARM_SUBSCRIPTION_ID ;
********************/data/testqa TF_TOKEN | TF_CLOUD_TOKEN

## To Reproduce
The yaml of the `vault-action` step, with any sensitive information masked or removed.

## Expected behavior
A clear and concise description of what you expected to happen.

## Log Output
For the most verbose logs, add a secret called
[`ACTIONS_STEP_DEBUG`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md)
with the value `true`. Then, re-run the workflow if possible and post the *raw
logs* for the step here with any sensitive information masked or removed.

## Additional context
Add any other context about the problem here.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the reported vault-action@v3 workflow step and its JWT authentication inputs: VAULT_ADDR, VAULT_NAMESPACE, VAULT_ROLE, and the secrets paths. Compare the failing configuration with the action's authentication behavior and reproduce the 400 response if possible; done means identifying a confirmed configuration or action defect and verifying successful token retrieval.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
authentication, ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.