hashicorp / hashicorp/vault-secrets-operator
defaultAuth not working with approle
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
I have configured VSO helm chart to have a default connection and default auth. Default auth is using appRole mount, with a secret that has the `id` key in the same namespace as the operator.
When trying to create a VaultStaticSecret that _should_ reference the default connection and auth, i'm getting errors saying it cannot find the approle secret referenced above.
```
{"level":"error","ts":"2025-01-09T00:28:49Z","msg":"Failed to get secret","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"gitlab-pull-secret","namespace":"gitlab"},"namespace":"gitlab","name":"gitlab-pull-secret","reconcileID":"fcfd47a3-bdb1-4e10-bb10-9bea37a09893","secret_name":"vault-approle-credentials","error":"secrets \"vault-approle-credentials\" not found"}
{"level":"error","ts":"2025-01-09T00:28:49Z","logger":"cachingClientFactory","msg":"Failed to get cacheKey from obj","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"gitlab-pull-secret","namespace":"gitlab"},"namespace":"gitlab","name":"gitlab-pull-secret","reconcileID":"fcfd47a3-bdb1-4e10-bb10-9bea37a09893","error":"secrets \"vault-approle-credentials\" not found"}
```
**To Reproduce**
Steps to reproduce the behavior:
1. Deploy VSO helm chart with default connection and default auth using approle.
2. Manually define approle secret id in a secret ref and specify that above in the helm chart for defaultAuthMethod.appRole.secretRef
3. Try to create a VaultStaticSecret in any other namespace without specifying vaultAuthRef.
4. See error (vault-secrets-operator logs)
5. Try to create VaultStaticSecret and specify vaultAuthRef=some-namespace/default.
6. See error.
Application deployment:
Helm deployment (v0.9.1).
```
defaultVaultConnection:
address: ...
enabled: true
caCertSecret: ...
controller:
replicas: 2
strategy:
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
type: RollingUpdate
defaultAuthMethod:
enabled: true
allowedNamespaces:
- '*'
method: appRole
mount: approle
namespace: ...
appRole:
roleId: ...
secretRef:
```
The secret clearly exists
```
~ kb get secret -n vault-secrets-operator vault-approle-credentials
NAME TYPE DATA AGE
vault-approle-credentials Opaque 1 85d
```
**Expected behavior**
The expectation is that the static secret will use the default auth when not specified.
**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): 1.30
* Other configuration options or runtime services (istio, etc.): n/a
* vault-secrets-operator version: 0.9.1 helm release
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing how defaultAuthMethod.appRole.secretRef is resolved when a VaultStaticSecret omits vaultAuthRef, especially across namespaces. Reproduce the Helm v0.9.1 configuration and check the operator logs; done when the referenced approle secret is found and the static secret can use the default auth without a not-found error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- authentication, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100