-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
1Password Connect Server: PushSecret will not delete item with multiple fields #5753
Description
Describe the bug
If you create a PushSecret with multiple keys, then deleting it will fail. When you run kubectl delete ... then it will say the PushSecret was deleted, however, the command will hang indefinitely. If you look at the corresponding 1Password (1P) item, you will see its fields get deleted over the course of a few minutes, but the command still hangs.
The only solution is to remove all finalizers from the secret with a command like kubectl patch pushsecret.external-secrets.io/test-secret-pushsecret -p '{"metadata":{"finalizers":[]}}' --type=merge. Then, you can delete the 1P item manually.
Note that this does not affect deleting a 1P item that has a single field. In that case, deletion will succeed. The only strange behavior is that the 1P item does not get deleted, only its single field. This leaves behind an empty 1P item. However, this might be the intended behavior.
To Reproduce
Steps to reproduce the behavior:
- Set up a Kubernetes cluster with the External Secret Operator.
- Set up a SecretStore that connects to 1Password by following this guide.
- Create a file named
test-pushsecret.yamlwith the following content. Replace anything beginning with "your" with the correct values:
apiVersion: v1
kind: Secret
metadata:
name: test-secret
namespace: your_namespace_here
type: Opaque
stringData:
username: test-user
password: mediocrefakepassword123
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
name: test-secret-pushsecret
namespace: your_namespace_here
spec:
deletionPolicy: Delete
refreshInterval: 1h
secretStoreRefs:
- name: your_secretstore_here
kind: SecretStore
selector:
secret:
name: test-secret
data:
- match:
secretKey: username
remoteRef:
remoteKey: test-secret
property: username
metadata:
apiVersion: kubernetes.external-secrets.io/v1alpha1
kind: PushSecretMetadata
spec:
vault: your_1P_vault_name_here
- match:
secretKey: password
remoteRef:
remoteKey: test-secret
property: password
metadata:
apiVersion: kubernetes.external-secrets.io/v1alpha1
kind: PushSecretMetadata
spec:
vault: your_1P_vault_name_here- Create the
SecretandPushSecretusingkubectl apply -f test-pushsecret.yaml - Delete the
PushSecretusingkubectl delete pushsecret.external-secrets.io/test-secret-pushsecret
Expected behavior
The kubectl delete command will hang indefinitely. The underlying 1P item will have its fields deleted, but it will persist.
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
Tested using ghcr.io/external-secrets/external-secrets:v1.1.1
Metadata
Metadata
Assignees
Labels
Type
Projects
Status