[Infisical] Sync doesn't fail if projectSlug is not available #4059
Description
Is your feature request related to a problem? Please describe.
I've created a SecretStore with a self-hosted Infisical server as provider. I first entered a wrong projectSlug. Both the SecretStore as well as the ExternalSecret looked fine, they both said that the secret was successfully synced.
Looking at the secret however shows that the Keys have an empty value.
See also #3686.
Describe the solution you'd like
If the External-Secrets-Operator is not able to retrieve a secret (project doesn't exist or missing permissions or similar), the Secret-Store should fail to validate.
Describe alternatives you've considered
If the SecretStore validation cannot check this, at least the ExternalSecret should fail to sync.
Additional context
I've tested the wrong request using an api client against the Infisical-Server and it returned a 500:
{"statusCode": 500,"message": "Something went wrong","error": "Find project by slug"}
So from Infisical's side the behaviour seems correct.
Manifest misconfigured SecretStore (retrieved from Kubernetes, but slightly cleaned up):
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: infisical-foo
namespace: external-secrets
spec:
provider:
infisical:
auth:
universalAuthCredentials:
clientId:
key: clientId
name: infisical-creds
namespace: external-secrets
clientSecret:
key: clientSecret
name: infisical-creds
namespace: external-secrets
hostAPI: https://infisical.change.me # changed for data protection
secretsScope:
environmentSlug: dev
projectSlug: foobar # project doesn't exist
secretsPath: /
status:
capabilities: ReadOnly
conditions:
- lastTransitionTime: "2024-10-29T14:30:24Z"
message: store validated
reason: Valid
status: "True"
type: Ready
Manifest ExternalSecret (retrieved from Kubernetes, but slightly cleaned up):
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: es-foo
namespace: external-secrets
spec:
data:
- remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: PASSWORD
metadataPolicy: None
secretKey: ADMIN_PASS
refreshInterval: 1h
secretStoreRef:
kind: SecretStore
name: infisical-foo
target:
creationPolicy: Owner
deletionPolicy: Retain
name: secret-foo
status:
binding:
name: secret-foo
conditions:
- lastTransitionTime: "2024-10-29T14:33:58Z"
message: Secret was synced
reason: SecretSynced
status: "True"
type: Ready
refreshTime: "2024-10-29T14:33:58Z"
syncedResourceVersion: 1-4fe8a58fdd8d1c1dbe5e34de2c39af9a
Manifest Secret (retrieved from Kubernetes, but slightly cleaned up):
apiVersion: v1
data:
ADMIN_PASS: ""
immutable: false
kind: Secret
metadata:
annotations:
reconcile.external-secrets.io/data-hash: 2f268487e7f9303c1fe8888de1ee50af
labels:
reconcile.external-secrets.io/created-by: 512949fc898ec69665a6157fa1ac81e1
name: secret-foo
namespace: external-secrets
type: Opaque