HashiCorp Vault Provider - Multiple secrets using dataFrom with Vault namespaces #3216
Description
Describe the bug
I’m trying to retrieve multiple secrets using the dataFrom spec against an enterprise version of Vault (Vault v1.15.5) using namespaces. The query fails with a 403 permission denied. This appears to be because the namespace isn't part of the HTTP request and it's trying to list secrets at the root path. The token used is scoped to a namespace.
To Reproduce
Steps to reproduce the behavior:
SecretStore
auth method omitted
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: example-secret-store
namespace: example-namespace
spec:
provider:
vault:
server: "https://[host]"
namespace: example-namespace
path: "secret"
version: "v2"
auth:
jwt:
...ExternalSecret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: test
namespace: example-namespace
spec:
refreshInterval: "15s"
secretStoreRef:
name: example-secret-store
kind: SecretStore
target:
name: foo
dataFrom:
- find:
conversionStrategy: Unicode
decodingStrategy: None
name:
regexp: ".*"
path: /Result
The namespace isn't part of the request:
https://[host]/v1/secret/metadata/secret?list=true\nCode: 403.
Errors:
1 error occurred:
* permission deniedWe see access denied because the token is scoped to a namespace.
Versions
| Component | Version |
|---|---|
| External Secrets Operator Chart | 0.9.9 |
| Vault Enterprise | 1.15.5 |
| Kubernetes | 1.28.5 |
Expected behavior
I believe the underlying request should contain the namespace? In this example example-namespace
https://[host]/v1/example-namespace/secret/metadata/secret?list=true Metadata
Metadata
Assignees
Type
Projects
Status