hashicorp / hashicorp/vault-secrets-operator

Two different VSO in different namespaces can render k8s secret.

Open
#349 2 comments 0 reactions 0 assignees View on GitHub
documentation enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**

If deploy in to the kubernetes cluster another VSO(in different namespace) he will not produce errors, that he can't not render secrets, and if first one VSO scale down to zero - he will be able to get secret from vault and render it to kubernetes secret

**To Reproduce**
Steps to reproduce the behavior:
1. deploy VSO into namespace one
2. configure k8s-auth by using his token
3. create vaultAuth valutConnection and vaultStaticSecret - to create some secret from vault
5. deploy another VSO to namespace two
6. scale down VSO in namespace one
7. delete kubenetes secret, which was create by VSO
8. VSO from namespace two, will create\render a kubernetes secret

**Expected behavior**

I see this like this:

VSO from the namespace two should not able to create\render secrets because he has different token.

**Environment**
* Kubernetes version: 1.24.x
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): kubernetes cluster deployed by RKE
* vault-secrets-operator version: 0.2.0

**Additional context**

when second VSO starts in logs of both VSO I see this

```
2023-09-01T11:33:38Z DEBUG events Secret sync not required {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"rabbitmq","name":"rmq-credentials","uid":"39324ff8-7905-47ee-ab74-e2b4f2173a8b","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348179499"}, "reason": "SecretSync"}
2023-09-01T11:33:46Z DEBUG events Secret sync not required {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"celery-exporter","name":"celery-exporter","uid":"67fc31c0-c558-42cb-a896-5169b52a0b70","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348179541"}, "reason": "SecretSync"}
2023-09-01T11:34:29Z DEBUG events Secret sync not required {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"rabbitmq","name":"rmq-credentials","uid":"39324ff8-7905-47ee-ab74-e2b4f2173a8b","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348179499"}, "reason": "SecretSync"}
2023-09-01T11:34:35Z DEBUG events Secret sync not required {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"celery-exporter","name":"celery-exporter","uid":"67fc31c0-c558-42cb-a896-5169b52a0b70","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348179541"}, "reason": "SecretSync"}
## At this point VSO from namespace two started
2023-09-01T11:35:19Z DEBUG events Secret synced {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"rabbitmq","name":"rmq-credentials","uid":"39324ff8-7905-47ee-ab74-e2b4f2173a8b","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348195897"}, "reason": "SecretRotated"}
2023-09-01T11:35:28Z DEBUG events Secret synced {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"celery-exporter","name":"celery-exporter","uid":"67fc31c0-c558-42cb-a896-5169b52a0b70","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348195895"}, "reason": "SecretRotated"}
2023-09-01T11:36:08Z DEBUG events Secret synced {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"rabbitmq","name":"rmq-credentials","uid":"39324ff8-7905-47ee-ab74-e2b4f2173a8b","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348196148"}, "reason": "SecretRotated"}
2023-09-01T11:36:16Z DEBUG events Secret synced {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"celery-exporter","name":"celery-exporter","uid":"67fc31c0-c558-42cb-a896-5169b52a0b70","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348196153"}, "reason": "SecretRotated"}
2023-09-01T11:36:57Z DEBUG events Secret synced {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"rabbitmq","name":"rmq-credentials","uid":"39324ff8-7905-47ee-ab74-e2b4f2173a8b","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348196372"}, "reason": "SecretRotated"}
2023-09-01T11:37:06Z DEBUG events Secret synced {"type": "Normal", "object": {"kind":"VaultStaticSecret","namespace":"celery-exporter","name":"celery-exporter","uid":"67fc31c0-c558-42cb-a896-5169b52a0b70","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"348196361"}, "reason": "SecretRotated"}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue using two VSO deployments in separate namespaces, following the listed VaultStaticSecret steps and watching both controllers' logs. Investigate why the second VSO reconciles the existing resources after the first is scaled down. Done means the second VSO cannot render or recreate secrets using a different token.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
backend, devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.