hashicorp / hashicorp/vault-secrets-operator

When deleting the latest version of a kv2 secret, VSO should retrieve the previous (non-deleted) version

Open
#756 2 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**

I use a VaultStaticSecret to retrieve the *latest* version of a secret stored in Vault by omitting the `version` attrbute:

```yaml
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: grafana-credentials
spec:
type: kv-v2
mount: secrets-external-services
path: oncall/grafana-credentials
destination:
name: grafana-credentials
create: true
rolloutRestartTargets:
- kind: Deployment
name: grafana
```

If I create a new version of this secret in Vault, VSO correctly updates to the new version and restarts the `grafana` deployment. Great!

But when I delete the new version of the secret in Vault, VSO does not revert to the previous version. Instead, it wipes the existing data from the Kubernetes `Secret` and restarts the Grafana deployment, making it fail because of the now missing data.

The updated `Secret` after deleting the version in Vault contains only this data:

```yaml
_raw: '{"data":null,"metadata":{"created_time":"2024-05-17T19:01:44.897386006Z","custom_metadata":null,"deletion_time":"2024-05-17T19:02:34.210821304Z","destroyed":false,"version":2}}'
```

**Expected behavior**

I would expect VSO to revert to the latest non-deleted version of the vault secret.

**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): K3s v1.29.3+k3s1
* vault-secrets-operator version: v0.6.0

**Additional context**

It is debatable if this is even a bug. This seems to be the default behavior of the Vault API when omitting the `version` parameter. See https://discuss.hashicorp.com/t/kv-v2-destroyed-secret-version-still-marked-as-current/9780

But I still think VSO should handle this better.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the case with a VaultStaticSecret using type kv-v2 and no version, then inspect the reconciliation path for how a deleted latest version is represented in the Kubernetes Secret. Done means the operator retains or retrieves the latest non-deleted Vault version instead of writing null data and restarting the target deployment with missing credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.