hashicorp / hashicorp/vault-secrets-operator

VaultStaticSecrets not resuming secret syncing post a Vault seal event

Open
#840 2 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
601
Forks
145
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
VaultSaticSecret doesnt resume syncing post a Vault being sealed, and then unsealed. Vault instance is external to the cluster and was successfully unsealed.

Expected VaultSaticSecret to resume syncing post unseal.

**To Reproduce**
1. Set up a VaultConnection and VaultAuth in the operator namespace.
2. Create a VaultStaticSecrert using default connection and auth
3. Confirm secret syncing
4. Terminate a Vault instance
5. Bring back up a Vault instance
6. Unseal
7. VaultStaticSecret will report 503 Vault is sealed permanenty

Application deployment:

```yaml
defaultVaultConnection:
enabled: true
address: "http://xxx:8200"
defaultAuthMethod:
enabled: true
namespace: ""
method: kubernetes
mount: xxx
kubernetes:
role: "xxx"
serviceAccount: vault-auth
```

Vault operator was restarted. No errors in the controller/operator logs pre or post the restart. Problem persisted for all VaultStaticSecrets.

**Expected behavior**
Expected VaultStaticSecret to resume post Vault becoming re-available, it seemed to stop after roughly 10 minutes but this is a best guess.

**Environment**
* Kubernetes version: 1.30.2
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): Bare metal / Talos Linux
* Other configuration options or runtime services (istio, etc.): Traefik
* vault-secrets-operator version: v1.7.1

**Additional context**
Add any other context about the problem here.

Contributor guide

No contributing guide indexed for this repository

Research direction

No source file or test is named in the report. Start by reproducing the Vault seal, restart, and unseal sequence with the listed VaultConnection, VaultAuth, and VaultStaticSecret setup, then inspect the operator behavior and logs; done means all VaultStaticSecrets resume syncing after Vault becomes available again.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.