ClusterSecretStore Kubernetes Provider shows expired bearer token as valid #5038
Description
Describe the bug
Creating a ClusterSecretStore with Kubernetes Provider using an expired bearer token authentication will show a "Valid" status in the secret store.
To Reproduce
Steps to reproduce the behavior:
ESO version: 0.18.2
Kubernetes version: 1.33 (kind)
- Prerequisites
apiVersion: v1
kind: Namespace
metadata:
name: testing
---
apiVersion: v1
kind: Secret
metadata:
name: top-secret
namespace: testing
type: Opaque
data:
secret: dGhpcyBpcyBhIHNlY3JldA==
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: admin-sa
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-sa-binding
subjects:
- kind: ServiceAccount
name: admin-sa
namespace: default
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io- Create a service account token with expiration
kubectl create token admin-sa --duration=600s- Create a Kubernetes Secret from the token
apiVersion: v1
kind: Secret
metadata:
name: my-token
namespace: default
data:
token: |
<base64 encoded token>- Create ClusterSecretStore with Kubernetes Provider using the bearer token
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
name: cluster-store
spec:
provider:
kubernetes:
remoteNamespace: testing
server:
url: "https://kubernetes.default.svc"
caProvider:
type: ConfigMap
name: kube-root-ca.crt
namespace: default
key: ca.crt
auth:
token:
bearerToken:
name: my-token
key: token
namespace: default- Create an ExternalSecret refering to the secret store
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: "hello-world"
namespace: default
spec:
refreshPolicy: Periodic
refreshInterval: "5s"
target:
name: hello-world
creationPolicy: Owner
deletionPolicy: Delete
data:
- secretKey: admin
remoteRef:
key: top-secret
version: v1
property: secret
decodingStrategy: None
sourceRef:
storeRef:
name: cluster-store
kind: ClusterSecretStore- When the token expired, the ClusterSecretStore status is still valid, but the ExternalSecret got
err: Unauthorized
Expected behavior
ClusterSecretStore shows authentication error for expired bearer token