hashicorp / hashicorp/vault-secrets-operator
v0.4.3 vault-secrets-operator crashes when deploying from a manually rendered Helm chart.
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
v0.4.3 vault-secrets-operator crashes, also verbs are missing for hcpauth, hcpvaultsecretsapps clusterrole, i expect these to be created with deployment/ CRDs
**To Reproduce**
Steps to reproduce the behavior:
1. Deploy 0.4.3 vault-secrets-operator
See error (vault-secrets-operator logs, application logs, etc.)
E0129 18:15:53.073016 1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1beta1.HCPVaultSecretsApp: failed to list *v1beta1.HCPVaultSecretsApp: hcpvaultsecretsapps.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpvaultsecretsapps" in API group "secrets.hashicorp.com" at the cluster scope
W0129 18:16:00.727099 1 reflector.go:539] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: failed to list *v1beta1.HCPVaultSecretsApp: hcpvaultsecretsapps.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpvaultsecretsapps" in API group "secrets.hashicorp.com" at the cluster scope
E0129 18:16:00.727258 1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1beta1.HCPVaultSecretsApp: failed to list *v1beta1.HCPVaultSecretsApp: hcpvaultsecretsapps.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpvaultsecretsapps" in API group "secrets.hashicorp.com" at the cluster scope
W0129 18:16:04.331736 1 reflector.go:539] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: failed to list *v1beta1.HCPAuth: hcpauths.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpauths" in API group "secrets.hashicorp.com" at the cluster scope
E0129 18:16:04.331906 1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1beta1.HCPAuth: failed to list *v1beta1.HCPAuth: hcpauths.secrets.hashicorp.com is forbidden: User "system:serviceaccount:vault-secrets-operator:vault-secrets-operator-controller-manager" cannot list resource "hcpauths" in API group "secrets.hashicorp.com" at the cluster scope
**Expected behavior**
stable deployment not crashing often, with clusterrole updated for hcpauth/hcpvaultsecretsapps.
**Environment**
ocp 4.14
* vault-secrets-operator version: 0.4.3
**Additional context**
Add any other context about the problem here.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by rendering the v0.4.3 Helm chart and inspecting the generated ClusterRole for hcpvaultsecretsapps and hcpauth. Reproduce the deployment on OpenShift 4.14, then verify the operator can list and watch both resources without the reported forbidden errors and remains stable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- authorization, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100