hashicorp / hashicorp/vault-secrets-operator

HCP Vault Secret - VSO want to use secret from different namespaces

Open
#423 14 comments 4 reactions 0 assignees View on GitHub
documentation
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
I have some applications that work in different namespaces on a cluster, and I want to provide passwords from HCP VS via VSO. I read the tutorial (which is very good 😄 ), but I got a small problem with the credentials secret. VSO requires from me to add a credentials secret in every namespace in which I used HCPVaultSecretApp object. For me is some kind of mismatch because VSO requires only one HCPAuth object on the cluster, but few identical secrets in every namespace that is used.

**To Reproduce**
Steps to reproduce the behavior:
1. Deploy the application with the following yaml file with the following VSO custom resources.
2. See an error in the controller log
```
manager 2023-10-23T21:00:46Z ERROR Get HCP Vault Secrets Client {"controller": "hcpvaultsecretsapp", "controllerGroup": "secrets.hashicorp.com", "controllerKind": "HCPVa
ultSecretsApp", "HCPVaultSecretsApp": {"name":"web-application","namespace":"abc"}, "namespace": "abc", "name": "web-application", "reconcileID": "71442300-2edd-40da-8ace-79c6eae
77f4e", "error": "failed to setup CredentialProvider, err=Secret \"vso-default-sp\" not found"}
```

Application deployment:

```yaml
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: HCPAuth
metadata:
name: default
namespace: vault-secrets-operator-system
spec:
organizationID: "..."
projectID: "..."
servicePrincipal:
secretRef: vso-default-sp
```

```yaml
---
apiVersion: v1
kind: Secret
metadata:
name: vso-default-sp
namespace: vault-secrets-operator-system
stringData:
clientID: "..."
clientSecret: "..."
```

```yaml
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: HCPVaultSecretsApp
metadata:
name: web-application
namespace: abc
spec:
hcpAuthRef: "vault-secrets-operator-system/default"
appName: abc-web-app
destination:
create: true
name: abc-secret
refreshAfter: 1h
```

**Expected behavior**
HCPAuth should use credentials secret from the same namespace where it is.

**Environment**
* Kubernetes version: v1.27.6 (k3s)
* vault-secrets-operator version: v0.3.4

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the reported HCPAuth and HCPVaultSecretsApp configuration on Kubernetes and inspect the controller log for the missing vso-default-sp Secret. Trace how the HCPAuth reference and service-principal Secret are resolved across namespaces. Done means applications in other namespaces can use the cluster-scoped authentication setup without duplicating the credentials Secret.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.