Fizcko / Azure_DevOps_Vault_Interaction

Azure DevOps extension to interact with HashiCorp Vault.
MIT License
10 stars 11 forks source link

Container Job Compatibility #15

Closed sjqnn closed 9 months ago

sjqnn commented 2 years ago

Is there a proven way/ is there some requirement to be installed in an image running this task to allow for it to be run in the context of a container job?

I tried using this task in a container, and it consistently came back with the following error. As soon as I switched it to just run on a bare rhel VM agent it worked fine.

(node:103) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 2): TypeError: Cannot read property 'data' of undefined 
Fizcko commented 2 years ago

I dont thinks that there is some requirements. Can you publish your YAML pipeline job ?

sjqnn commented 2 years ago

Its an internal repo to my org, but i can provide an example similar to what we want to do.

stages:
  - stage: GetSecret
    displayName: "Get Secret"
    jobs:
      - job: GetSecret
        container: python:3.8-slim-buster
        displayName: "Get Secret"
        steps:
          - task: VaultReadKV@4
            inputs:
              strUrl: '<INTERNAL_VAULT_URL>'
              ignoreCertificateChecks: false
              useProxy: 'none'
              strAuthType: 'approle'
              strRoleID: '<INTERNAL_ROLE_ID>'
              strSecretID: '<INTERNAL_SECRET_ID>'
              strKVEnginePath: '<INTERNAL_ENGINE_PATH>'
              kvVersion: 'v2'
              strSecretPath: '<INTERNAL_PATH_TO_SECRET>'
              strPrefixType: 'custom'
              replaceCR: false
Fizcko commented 2 years ago

Thanks i will try to reproduce the error.

Fizcko commented 2 years ago

@sjqnn i'm not able to reproduce the same error. Is it possible to get more logs even censured ? You can run the task in debug mode like this

stages:
  - stage: GetSecret
    displayName: "Get Secret"
    jobs:
      - job: GetSecret
        variables:
          - name: System.Debug
            value: true
        container: python:3.8-slim-buster
...
sjqnn commented 2 years ago

System.Debug was enabled when we ran it, thats the only log that seemed relevant, the rest seemed to be just environment variables/parameters getting printed out which if i were to post would be largely censored out as well. At this point we've given up trying to run it in a container and just using it on the bare VM is meeting our needs.