Skip to content

Can't retrieve secrets when working with Gitlab variables at group level defined for different environments #3379

@felixprado-mc

Description

@felixprado-mc

Describe the bug
We are getting an error when retrieving some variables in Gitlab that:

  • Are defined at the group level (instead of the project level).
  • Have different values for environments (review/*, dev, stage and prod)

The error we receive is:
error retrieving secret at .data[1], key: MY_VARIABLE, err: GET https://gitlab.com/api/v4/groups/XXXXXXX/variables/MY_VARIABLE: 409 {message: There are multiple variables with provided parameters. Please use 'filter[environment_scope]'}

I'm pretty convinced that in this particular case, the query does not includes that filter. I have made the same request with Postman (see snapshots) and using the same token that ExternalSecret uses and I can retrieve the variable:

To Reproduce
1- These are my manifests. You can't reproduce the issue but at least see the configuration.
2. Kubernetes version; v1.27.9
ESO: v0.9.14

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: my-product
spec:
  provider:
    gitlab:
      auth:
        SecretRef:
          accessToken:
            key: EXTERNAL_SECRETS_GITLAB_TOKEN
            name: external-secret-gitlab-token
      environment: dev
      groupIDs:
      - "{my_group_id}"
      projectID: "{my_project_id}"
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name:  my-product
spec:
  data:
  - remoteRef:
      key: MY_VARIABLE
    secretKey: MY_VARIABLE
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name:  my-product
  target:
    creationPolicy: Owner
    name: secrets-external

Expected behavior
The variable can be retrieved as any other using ExternalSecrets even if it has different values per environment.

Screenshots
image

image

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions