search

cyberark / conjur-authn-k8s-client

Authentication sidecar for Conjur Kubernetes integration.
https://www.conjur.org
Apache License 2.0
11 stars 14 forks source link

Constant CSPFK010E Failed to authenticate error on startup #146

Closed sigalsax closed 4 years ago

sigalsax commented 4 years ago

Summary

The following failure log appears every time at the start of Secrets Provider.

ERROR: 2020/08/13 11:21:42 authenticator.go:140: CAKC011E Client certificate not found at '/etc/conjur/ssl/client.pem'
ERROR: 2020/08/13 11:21:42 authenticator.go:184: CAKC015E Login failed
ERROR: 2020/08/13 11:21:42 main.go:85: CSPFK010E Failed to authenticate

Steps to Reproduce

Steps to reproduce the behavior:

  1. Deploy the Secrets Provider or authn-client
  2. Check Secrets Provider /authn client logs
  3. See failure
Screen Shot 2020-08-13 at 3 07 08 PM

Expected Results

This initial error log should be appear

Actual Results (including error logs, if applicable)

A clear and concise description of what actually did happen.

Reproducible

Environment setup

Can you describe the environment in which this product is running? Is it running on a VM / in a container / in a cloud? Container locally Which cloud provider? Which container orchestrator (including version)? The more info you can share about your runtime environment, the better we may be able to reproduce the issue.

Additional Information

Add any other context about the problem here.

JfcAtCyberArk commented 4 years ago

Hi there,

I got the exact same issue this morning. /var/log/nginx/access.log from the master says it replied 200 to the inject_client_cert request. Still, got CAKC011E at the authenticator level. First time I run into this.

JFC

izgeri commented 4 years ago

@sigalsax is this a duplicate of #119?

sigalsax commented 4 years ago

@izgeri yes indeed

izgeri commented 4 years ago

@sigalsax can we consolidate the issues then? We can either keep this one or #119.

FYI, fixing this will impact the operation of Secretless too, and will prompt the need for long-time stability tests for another Secretless stable release. I strongly suggest running long-time stability tests for the changes made in this project too, to ensure that the sidecar container continues to operate as expected through token and certificate rotations.

sigalsax commented 4 years ago

closing due to duplication