[Infisical] accessing nested items doesn't let you choose folder #4298
Description
Describe the bug
When trying to access nested items (SecretStore has recursive: true set), it's not possible to choose the path where a secret should lie.
With data, I can only fetch secrets of root layer.
With dataFrom, I can fetch secrets from the whole recursive filestructure specified in the SecretStore, but I cannot provide a path, so when a key is used multiple times, it's random which secret is fetched.
To Reproduce
Steps to reproduce the behavior:
Infisical Version: 1.3.0
External-Secrets Version: 0.12.1
Kubernetes Version: v1.29.11
- Create a Test Secrets Project in Infisical called test-for-github with the following Secrets Layout:
SECRET_LAYER_0 -> Value: SECRET_LAYER_0
folder0
UNIQUE_SECRET -> Value: UNIQUE_SECRET
SECRET_LAYER_1 -> Value: SECRET_LAYER_1_0
folder1
SECRET_LAYER_1 -> Value: SECRET_LAYER_1_1
- Create a Machine identity with role Admin (just for testing, reduce it if you want) to the Project.
- Add a Secret with the Client Credentials to the Kubernetes Test Namespace (for naming, see SecretStore Manifest)
- Create a SecretStore like this:
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: test-for-github
spec:
provider:
infisical:
auth:
universalAuthCredentials:
clientId:
key: clientId
name: infisical-creds
clientSecret:
key: clientSecret
name: infisical-creds
hostAPI: https://infisical.example.com # ChangeThis
secretsScope:
environmentSlug: staging
projectSlug: test-for-github-dbn-j # ChangeThis
recursive: true
secretsPath: /
- Create an External Secret (different Options and their results as comments in Manifest):
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: es-test
spec:
refreshInterval: 1m
secretStoreRef:
name: test-for-github
kind: SecretStore
target:
name: es-test
creationPolicy: Owner
data:
# ### Option 1: simple access
# # Result: Works for Secrets in 0. Layer (SECRET_LAYER_0), but when specifying something else, the key is ""
# - secretKey: key
# remoteRef:
# key: SECRET_LAYER_0 # SECRET_LAYER_0 or SECRET_LAYER_1 or UNIQUE_SECRET
# ### Option 2: data with path
# # Result: doesn't work, because it's using the whole path as "Secret-Key" with `secretPath=/`, therefore its key is ""
# # See Logline: "Route GET:/api/v3/secrets/raw/folder0/SECRET_LAYER_1?environment=staging&include_imports=true&secretPath=%2F&workspaceSlug=test-for-github-dbn-j not found"
# - secretKey: key
# remoteRef:
# key: folder0/SECRET_LAYER_1
# ### Option 3: dataFrom with name
# # Result: Works with `SECRET_LAYER_0` and `UNIQUE_SECRET`, but with `SECRET_LAYER_1`, it saves value `SECRET_LAYER_1_1`
# dataFrom:
# - find:
# name:
# regexp: "SECRET_LAYER_1"
# ### Option4: dataFrom with path and name
# # Result: doesn't work at all. As soon as I specify `path`, it doesn't create a secret anymore
# # The Log-Lines also don't show anything, only the requests of the SecretStore to `"/api/v3/secrets/raw?environment=staging&expandSecretReferences=true&include_imports=true&recursive=true&secretPath=%2F&workspaceSlug=test-for-github-dbn-j"`
# dataFrom:
# - find:
# path: folder0
# name:
# regexp: "SECRET_LAYER_1"
Expected behavior
When creating a SecretStore with spec.provider.infisical.secretsScope.recursive=true and creating an External-Secret with
dataFrom:
- find:
path: folder0
name:
regexp: "SECRET_LAYER_1"
it should access the Secret folder0/SECRET_LAYER_1. Instead it doesn't create the Secret and sets the External-Secret to the state SecretSynced with message "secret retained due to DeletionPolicy=Retain"
Additional context
I've checked the Request that is done by the SecretStore
curl --request GET \
--url 'https://infisical.example.com/api/v3/secrets/raw?environment=staging&expandSecretReferences=true&include_imports=true&recursive=true&secretPath=%252F&workspaceSlug=test-for-github-dbn-j' \
--header 'authorization: Bearer SECRETBEARERTOKEN'
and it returns all the secrets, even both SECRET_LAYER_1 with their different values, but also different secretPath's.