hashicorp / hashicorp/vault-secrets-operator
Using remote namespace with VaultAuthRef doesn't work with approle secretid unless copied to local namespace
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
Not sure if this is a bug report or feature request, or if its even possible.
When using vauthAuthRef to point to a VaultAuth in an external namespace, it is unable to reference the approle secretid when stored in a kubernetes secret.
```
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: test-vault-sync
namespace: notvault
spec:
type: kv-v2
mount: prod
path: test/config
destination:
name: testsecret1
create: true
refreshAfter: 30s
vaultAuthRef: vault/static-auth
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: static-auth
namespace: vault
spec:
method: appRole
mount: vault-secrets-operator-approle
vaultConnectionRef: vault/default
allowedNamespaces:
- "*"
appRole:
roleId: 'xxxx'
secretRef: vault-secrets-operator-approlesecret
```
Results in the following error:
```
Failed to get cacheKey from obj, err=Secret "vault-secrets-operator-approlesecret" not found {"type": "Warning", "object": {"kind":"VaultStaticSecret","namespace":"notvault
","name":"test-vault-sync","uid":"xxxx","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"1062772150"}, "reason": "Unrecoverable"}
Failed to get Vault auth login: Secret "vault-secrets-operator-approlesecret" not found {"type": "Warning", "object": {"kind":"VaultStaticSecret","namespace":"notvault","na
me":"test-vault-sync","uid":"xxxx","apiVersion":"secrets.hashicorp.com/v1beta1","resourceVersion":"1062772150"}, "reason": "VaultClientConfigError"}
```
As soon as I add the kube secret 'vault-secrets-operator-approlesecret' to the 'notvault' namespace as well, it starts to work again.
Obviously it is not ideal to have to copy the secretid into every namespace that requires it, as rotating that secret would now become costly in an environment with dozens of namespaces. Is there a better way to do this? Or am I asking for something that just isn't possible? Thank you.
**Expected behavior**
VaultStaticSecret in a namespace outside of the VaultAuth object, but referenced with refVaultAuth, is able to use the secrets referenced in VaultAuth without copying them to the local namespace.
**Environment**
* Kubernetes version: GKE 1.26
* vault-secrets-operator version: 0.4.3
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the configuration with VaultStaticSecret and VaultAuth in separate namespaces, using the Kubernetes Secret named in appRole.secretRef. Trace how the external vaultAuthRef resolves that secret and compare it with the working duplicated-secret case. Done means the VaultStaticSecret can use the VaultAuth namespace's AppRole secret without copying it into the workload namespace, with appropriate behavior when the reference is invalid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100