search

argoproj-labs / argocd-vault-plugin

An Argo CD plugin to retrieve secrets from Secret Management tools and inject them into Kubernetes secrets
https://argocd-vault-plugin.readthedocs.io
Apache License 2.0
834 stars 193 forks source link

no permission to vault after update from 1.16.1 to 1.18.1 #661

Open dotdate opened 2 months ago

dotdate commented 2 months ago

Describe the bug updated from 1.16.1 to 1.17.1/1.18.1 Most applications are working normally after a while they got permission denied to Vault. We actually did a parallel installation too so it can use the same Approle as 1.16.1. Some applications getting permission denied immediately. Others are running for weeks without a problem. We let the plugin run on aks via another container

To Reproduce Steps to reproduce the behavior:

  1. update to 1.17.1/1.18.1
  2. change the plugin the applications from argocd

Expected behavior It's expected to run normally as before with 1.16.1.

Screenshots/Verbose output Unable to save changes: application spec for aifind-ci is invalid: InvalidSpecError: Unable to generate manifests in kustomized/configurations/ci-timesheet: rpc error: code = Unknown desc = plugin sidecar failed. error generating manifests in cmp: rpc error: code = Unknown desc = error generating manifests:sh -c "kustomize build . | argocd-vault-plugin generate -"failed exit status 1: Error: Replace: could not replace all placeholders in Template: Error making API request. URL: GET https://vault-domain.com/v1/PROJECT/data/PROJECT/PROJECT/secret Code: 403. Errors: * 1 error occurred: * permission denied Error making API request. URL: GET

pre commented 2 months ago

Might be the same issue we're having: