Webhook Generator JSON Issues #3239
Description
Describe the bug
When using the Webhook generator there seems to be some issues parsing non-string types in the response JSON:
"could not generate [0]: failed to get response (wrong type in key 'expires_in': float64)"
The request works with the non-generator version of the Webhook provider and digging through the code it seems like some of the conversion logic implemented here is missing here. The issue seems very reminiscent of #2899 .
To Reproduce
The API response the Webhook is receiving looks like:
{
"access_token": "long_jwt_token",
"expires_in": 86400,
"issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
"token_type": "Bearer"
}
Haven't quite poked through the code enough to try to work that into a unit test and try to fix it myself. Golang is not my strong suite but I've done some from time to time.
The resources I've been testing with look like this:
apiVersion: generators.external-secrets.io/v1alpha1
kind: Webhook
metadata:
name: artifactory-role-token-generator-2
spec:
method: "POST"
url: https://example.com/access/api/v1/oidc/token
result:
jsonPath: "$"
body: |
{
"grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
"subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
"subject_token": "{{ "{{" }} .oidc_token.token {{ "}}" }}",
"provider_name": "eks-rdssis-dev"
}
headers:
Content-Type: application/json
secrets:
- name: oidc_token
secretRef:
name: role-oidc-token
---
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: webhook-backend
spec:
provider:
webhook:
method: "POST"
url: https://example.com/access/api/v1/oidc/token
result:
jsonPath: "$"
body: |
{
"grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
"subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
"subject_token": "{{ "{{" }} .oidc_token.token {{ "}}" }}",
"provider_name": "eks-rdssis-dev"
}
headers:
Content-Type: application/json
secrets:
- name: oidc_token
secretRef:
name: role-oidc-token
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: artifactory-external-secret-loader-opaque-3
spec:
refreshInterval: "20h"
target:
name: token-test
secretStoreRef:
name: webhook-backend
kind: SecretStore
data:
- secretKey: foobar
remoteRef:
key: secret
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: artifactory-external-secret-loader-opaque-2
spec:
refreshInterval: "20h"
target:
# Name of the private registry secret to create
name: niartifacts-pre
template:
data:
".dockerconfigjson": 'long-template-string-here'
type: kubernetes.io/dockerconfigjson
dataFrom:
- sourceRef:
generatorRef:
apiVersion: generators.external-secrets.io/v1alpha1
kind: Webhook
name: artifactory-role-token-generator-2
---
I'm using ESO version 0.9.13 .