ExternalSecret that refer ECRAuthorizationToken not work in 0.18.0 #4935
Description
Describe the bug
After we upgrade the external-secrets version to 0.18.0, the externalsecret that refer the ECRAuthorizationToken report the error, but it works with version 0.17.0(refer the manifest below, it works).
looks like it will not use the IRSA permission to perform the ECR: GetAuthorizationToken. The logs find in controller:
{"level":"error","ts":1750228541.0351596,"msg":"Reconciler error","controller":"externalsecret","controllerGroup":"external-secrets.io","controllerKind":"ExternalSecret","ExternalSecret":{"name":"repository-ecr","namespace":"argocd"},"namespace":"argocd","name":"repository-ecr","reconcileID":"xxxxxxxxx","error":"error processing spec.dataFrom[0].sourceRef.generatorRef, err: error using generator: unable to get authorization token: operation error ECR: GetAuthorizationToken, https response error StatusCode: 400, RequestID: xxxxxxxxx, api error MissingAuthenticationTokenException: Missing Authentication Token","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
To Reproduce
Steps to reproduce the behavior:
- The ECRAuthorizationToken manifest
apiVersion: generators.external-secrets.io/v1alpha1
kind: ECRAuthorizationToken
metadata:
name: ecr-auth-token
namespace: argocd
spec:
region: ap-southeast-2- The ExternalSecret manifest
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: repository-ecr
namespace: argocd
spec:
dataFrom:
- sourceRef:
generatorRef:
apiVersion: generators.external-secrets.io/v1alpha1
kind: ECRAuthorizationToken
name: ecr-auth-token
refreshInterval: 30m
target:
creationPolicy: Owner
deletionPolicy: Retain
template:
data:
enableOCI: "true"
password: "{{ .password }}"
type: helm
url: 11111111111.dkr.ecr.ap-southeast-2.amazonaws.com
username: "{{ .username }}"
engineVersion: v2
mergePolicy: Replace
metadata:
labels:
argocd.argoproj.io/secret-type: repo-creds
type: OpaqueThe AWS role permission:
Kubernetes version: 1.31(EKS)
ESO version: 0.18.0
Expected behavior
The ExternalSecret should works fine with ECRAuthorizationToken. I know there are some refactor of AWS, but from the docs, not mention the manifest need some change(diff the old version with the latest).