hashicorp / hashicorp/vault-secrets-operator

VSO helm test does not take into account the service account

Open
#485 2 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
When launching the helm tests, they do not run as a service account with the proper credentials and they fail with :
```
{"level":"info","ts":"2023-11-28T23:43:56Z","logger":"initCachingClientFactory","msg":"Initializing the CachingClientFactory"}
2023-11-28T23:43:56Z ERROR setup Failed to setup the Vault ClientFactory {"error": "secrets is forbidden: User \"system:serviceaccount::default\" cannot create resource \"secrets\" in API group \"\" in the namespace \"\""}
main.main
/home/runner/work/vault-secrets-operator/vault-secrets-operator/main.go:215
runtime.main
/opt/hostedtoolcache/go/1.21.3/x64/src/runtime/proc.go:267
```

**To Reproduce**
Steps to reproduce the behavior:
1. Launch a k3d cluster
2. install vault + vso

**Expected behavior**
Maybe the test should use the same SA that vso uses ?

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with a k3d cluster, Vault, and VSO installed, then inspect the Helm test setup and compare its service account with the one used by VSO. Done means the Helm tests run under the intended service account and no longer fail with the forbidden secrets error.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
authorization, devops, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.