hashicorp / hashicorp/vault-secrets-operator

defaultAuth not working with approle

Open
#999 4 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
I have configured VSO helm chart to have a default connection and default auth. Default auth is using appRole mount, with a secret that has the `id` key in the same namespace as the operator.

When trying to create a VaultStaticSecret that _should_ reference the default connection and auth, i'm getting errors saying it cannot find the approle secret referenced above.

```
{"level":"error","ts":"2025-01-09T00:28:49Z","msg":"Failed to get secret","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"gitlab-pull-secret","namespace":"gitlab"},"namespace":"gitlab","name":"gitlab-pull-secret","reconcileID":"fcfd47a3-bdb1-4e10-bb10-9bea37a09893","secret_name":"vault-approle-credentials","error":"secrets \"vault-approle-credentials\" not found"}
{"level":"error","ts":"2025-01-09T00:28:49Z","logger":"cachingClientFactory","msg":"Failed to get cacheKey from obj","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"gitlab-pull-secret","namespace":"gitlab"},"namespace":"gitlab","name":"gitlab-pull-secret","reconcileID":"fcfd47a3-bdb1-4e10-bb10-9bea37a09893","error":"secrets \"vault-approle-credentials\" not found"}
```

**To Reproduce**
Steps to reproduce the behavior:
1. Deploy VSO helm chart with default connection and default auth using approle.
2. Manually define approle secret id in a secret ref and specify that above in the helm chart for defaultAuthMethod.appRole.secretRef
3. Try to create a VaultStaticSecret in any other namespace without specifying vaultAuthRef.
4. See error (vault-secrets-operator logs)
5. Try to create VaultStaticSecret and specify vaultAuthRef=some-namespace/default.
6. See error.

Application deployment:
Helm deployment (v0.9.1).
```
defaultVaultConnection:
address: ...
enabled: true
caCertSecret: ...
controller:
replicas: 2
strategy:
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
type: RollingUpdate
defaultAuthMethod:
enabled: true
allowedNamespaces:
- '*'
method: appRole
mount: approle
namespace: ...
appRole:
roleId: ...
secretRef:
```

The secret clearly exists
```
~ kb get secret -n vault-secrets-operator vault-approle-credentials
NAME TYPE DATA AGE
vault-approle-credentials Opaque 1 85d
```

**Expected behavior**
The expectation is that the static secret will use the default auth when not specified.

**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): 1.30
* Other configuration options or runtime services (istio, etc.): n/a
* vault-secrets-operator version: 0.9.1 helm release

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how defaultAuthMethod.appRole.secretRef is resolved when a VaultStaticSecret omits vaultAuthRef, especially across namespaces. Reproduce the Helm v0.9.1 configuration and check the operator logs; done when the referenced approle secret is found and the static secret can use the default auth without a not-found error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
authentication, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.