hashicorp / hashicorp/vault-secrets-operator

v0.4.3 vault-secrets-operator crashes when deploying from a manually rendered Helm chart.

Open
#575 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
v0.4.3 vault-secrets-operator crashes, also verbs are missing for hcpauth, hcpvaultsecretsapps clusterrole, i expect these to be created with deployment/ CRDs

**To Reproduce**
Steps to reproduce the behavior:
1. Deploy 0.4.3 vault-secrets-operator

See error (vault-secrets-operator logs, application logs, etc.)

E0129 18:15:53.073016 1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1beta1.HCPVaultSecretsApp: failed to list *v1beta1.HCPVaultSecretsApp: hcpvaultsecretsapps.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpvaultsecretsapps" in API group "secrets.hashicorp.com" at the cluster scope
W0129 18:16:00.727099 1 reflector.go:539] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: failed to list *v1beta1.HCPVaultSecretsApp: hcpvaultsecretsapps.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpvaultsecretsapps" in API group "secrets.hashicorp.com" at the cluster scope
E0129 18:16:00.727258 1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1beta1.HCPVaultSecretsApp: failed to list *v1beta1.HCPVaultSecretsApp: hcpvaultsecretsapps.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpvaultsecretsapps" in API group "secrets.hashicorp.com" at the cluster scope
W0129 18:16:04.331736 1 reflector.go:539] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: failed to list *v1beta1.HCPAuth: hcpauths.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpauths" in API group "secrets.hashicorp.com" at the cluster scope
E0129 18:16:04.331906 1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1beta1.HCPAuth: failed to list *v1beta1.HCPAuth: hcpauths.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpauths" in API group "secrets.hashicorp.com" at the cluster scope

**Expected behavior**
stable deployment not crashing often, with clusterrole updated for hcpauth/hcpvaultsecretsapps.

**Environment**
ocp 4.14
* vault-secrets-operator version: 0.4.3

**Additional context**
Add any other context about the problem here.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by rendering the v0.4.3 Helm chart and inspecting the generated ClusterRole for hcpvaultsecretsapps and hcpauth. Reproduce the deployment on OpenShift 4.14, then verify the operator can list and watch both resources without the reported forbidden errors and remains stable.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
authorization, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.