Closed Foxboron closed 4 months ago
Closing this as there has been a 0.17.1
release with https://github.com/hashicorp/vault-plugin-secrets-azure/pull/194
We haven't tested this patch ourself yet, but I'll close this for good measure :)
Thanks for the quick fix @vinay-gopalan and @hsimon-hashicorp
I'm still seeing this issue with 0.17.1 (built into Vault Enterprise 1.16.2):
goroutine 9184635 [running]:
[ ... ]
github.com/hashicorp/vault-plugin-secrets-azure.(*client).unassignRoles(0xc0224dceb0, {0xd56c9e8, 0xc013974380}, {0xc00bdb13a0?, 0x1, 0xc023bc4a50?})
/home/runner/go/pkg/mod/github.com/hashicorp/vault-plugin-secrets-azure@v0.17.1/client.go:221 +0x136 fp=0xc013921110 sp=0xc013921080 pc=0x7540e16
github.com/hashicorp/vault-plugin-secrets-azure.(*azureSecretBackend).rollbackRoleAssignWAL(0xc008d8f920, {0xd56c9e8, 0xc013974380}, 0xc0121070e0, {0x958ec60, 0xc007deaed0})
/home/runner/go/pkg/mod/github.com/hashicorp/vault-plugin-secrets-azure@v0.17.1/wal.go:157 +0x4ff fp=0xc013921238 sp=0xc013921110 pc=0x754ebdf
github.com/hashicorp/vault-plugin-secrets-azure.(*azureSecretBackend).walRollback(0x10fe414?, {0xd56c9e8?, 0xc013974380?}, 0x20e?, {0xc012d61b50?, 0xc009828f40?}, {0x958ec60?, 0xc007deaed0?})
/home/runner/go/pkg/mod/github.com/hashicorp/vault-plugin-secrets-azure@v0.17.1/wal.go:33 +0x94 fp=0xc013921288 sp=0xc013921238 pc=0x754dd74
github.com/hashicorp/vault-plugin-secrets-azure.(*azureSecretBackend).walRollback-fm({0xd56c9e8?, 0xc013974380?}, 0x13955140?, {0xc012d61b50?, 0x30acd41c6bfd?}, {0x958ec60?, 0xc007deaed0?})
<autogenerated>:1 +0x58 fp=0xc0139212d8 sp=0xc013921288 pc=0x7551258
github.com/hashicorp/vault/sdk/framework.(*Backend).handleWALRollback(0xc008d9c2d0, {0xd56c9e8, 0xc013974380}, 0xc0121070e0)
/home/runner/actions-runner/_work/vault-enterprise/vault-enterprise/sdk/framework/backend.go:714 +0x3c3 fp=0xc013921410 sp=0xc0139212d8 pc=0x10f1623
[ ... ]
We've filed Hashicorp support ticket #149475 to track this too.
I believe the cause is that the right side of this &&
operation should be in parenthesis:
if rawResponse != nil && (rawResponse.StatusCode == http.StatusNoContent || rawResponse.StatusCode == http.StatusNotFound) {
continue
}
We where in the middle of upgrading our vault cluster from 1.15.6 to 1.16.1 when the servers started failing. It seems like there is an issue when azure roles are being unassigned and it causes the vault service to crash.
I suspect the root of this issue is this change from the REST API to the graph API client and that
rawResponse
is stillnil
when we are peeking at thestatusCode
.Traceback: