hashicorp / hashicorp/vault-secrets-operator

Vault Dynamic secret AWS not updated

Open
#275 11 comments 1 reaction 1 assignee Claimed by @benashz View on GitHub
dynamic enhancement needs-events
Dominant language
Go
Stars
601
Forks
145
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
Credential type: IAM_USER
VSO: 0.1.0
Vault: 1.12.1

The VaultDynamicSecret is not renewed

```
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
creationTimestamp: "2023-06-20T07:20:35Z"
generation: 1
labels:
kustomize.toolkit.fluxcd.io/name: ubble-devops-workloads
kustomize.toolkit.fluxcd.io/namespace: flux-system
name: minio-encrypted-aws-account
namespace: minio
resourceVersion: "618772646"
uid: b57d6fd7-ca30-4afa-a5a6-6098304db2e9
spec:
destination:
create: true
name: minio-encrypted-aws-account
mount: aws
path: creds/minio-encrypted-aws
renewalPercent: 67
rolloutRestartTargets:
- kind: Deployment
name: minio-encrypted-aws
vaultAuthRef: minio-encrypted-aws
```

If i check on my AWS IAM, i have no user created.
I check the k8s generated secret, i have an accessKey and secretKey but it not work.
I have trying to restart VSO without success.

Here is the status of the `VaultDynamicSecret` after the restart:
```
Status:
Last Generation: 1
Last Renewal Time: 1687247954
Last Runtime Pod UID: 52d14ca0-b6cf-4dec-aac2-60e2dd49787d
Secret Lease:
Duration: 2764800
Id: aws/creds/minio-encrypted-aws/xnbo15l2p5phfLsb7EL9X8Kn
Renewable: true
Request ID: c5505f06-1a05-87b3-f89f-8c0c1f1eaffe
Static Creds Meta Data:
Last Vault Rotation: 0
Rotation Period: 0
Ttl: 0
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal SecretLeaseRenewal 7m23s VaultDynamicSecret Not in renewal window after transitioning to a new leader/pod, lease_id=aws/creds/minio-encrypted-aws/xnbo15l2p5phfLsb7EL9X8Kn, horizon=574h41m59.877389462s
```

If i drop the K8s secret and the Dynamic secret and re-deploy it, the secret is well generated with a valid accessKey and secretKey.

**To Reproduce**
Steps to reproduce the behavior:
1. Deploy application with the following yaml file with the following VSO custom resources.
2. Any custom resources used for your secrets.
3. ...
5. See error (vault-secrets-operator logs, application logs, etc.)

Application deployment:

```yaml
# Paste your application deployment yaml and custom resources here.
# Be sure to scrub any sensitive values!
```

Other useful info to include: `kubectl describe deployment ` and `kubectl describe ` output.

**Expected behavior**
I expect a Secret renewal with an IAM_USER AWS VaultDynamicSecret

**Environment**
* Kubernetes version: 1.22.2
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): On-premise
* vault-secrets-operator version: 0.1.0

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.