chore(previder): Update Previder Provider dependency and fix ReadOnly token#5327
Merged
Skarlso merged 9 commits intoexternal-secrets:mainfrom Oct 8, 2025
Merged
Conversation
…ting the SecretStore in the Previder Provider Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl>
Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl>
Contributor
|
Can you please provide the scenario and an error on what's happening and why this fix is needed? |
webstradev
reviewed
Sep 16, 2025
Contributor
Author
|
I added more information to the description of the PR. This should describe why this fix is needed. |
Signed-off-by: Gijs Middelkamp <17021438+gkwmiddelkamp@users.noreply.github.com>
…wClient method Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl>
…ROVIDER_PREVIDER_UPDATE
Skarlso
reviewed
Sep 17, 2025
Skarlso
approved these changes
Sep 20, 2025
jakobmoellerdev
approved these changes
Sep 30, 2025
Contributor
|
@gkwmiddelkamp Please update your branch so we can merge it. :) |
Contributor
|
@gkwmiddelkamp Please do it again. :) |
|
SamuelMolling
pushed a commit
to SamuelMolling/external-secrets
that referenced
this pull request
Oct 24, 2025
… token (external-secrets#5327) * Updated vault-cli to 0.1.3 and fixed ReadOnly token logic when validating the SecretStore in the Previder Provider Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl> * Fixed unit test Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl> * Made Validate method stateless. Moved setting the TokenType to the NewClient method Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl> --------- Signed-off-by: Gijs Middelkamp <g.middelkamp@previder.nl> Signed-off-by: Gijs Middelkamp <17021438+gkwmiddelkamp@users.noreply.github.com> Signed-off-by: Samuel Molling <samuelmolling@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



Problem Statement
When using a ReadOnly type token, the pod crashes because of a log failure in de vault-cli.
Also when validating the store, the Provider always tried to get the list of secrets which is not allowed with a ReadOnly token. This will now get the token info endpoint and save the type of token for future reference when we're implementing writing and creating secrets also.
The Previder vault support 2 types of tokens to manage/read secrets.
ReadWrite has the following privileges:
ReadOnly token has the next privilege:
The ReadOnly token is meant for in-cluster use for enhanced security, but is not allowed to List secrets. The current code calls the GetSecrets method which always errors out with a 401 Unauthorized for a ReadOnly and should not be used for validating the store.
Instead we changed it to the GetTokenInfo method which returns information about the current used token. This is the only call that will work for both kind of tokens.
The version of the client has already been updated in another PR, in version 0.1.2 we logged using "log.Fatal" when a 401 was thrown, which killed the daemon when using a ReadOnly token. This has been fixed to a proper log line in 0.1.3.
Checklist
git commit --signoffmake testmake reviewable