jenkinsci / hashicorp-vault-plugin

Jenkins plugin to populate environment variables from secrets stored in HashiCorp's Vault.
https://plugins.jenkins.io/hashicorp-vault-plugin/
MIT License
217 stars 143 forks source link

NullPointerException return value of "hudson.model.View.getOwner()" is null #323

Closed zisuu closed 5 months ago

zisuu commented 9 months ago

Jenkins and plugins versions report

Environment ```text Jenkins: 2.426.1 OS: Linux - 4.18.0-477.27.1.el8_8.x86_64 Java: 17.0.9 - Eclipse Adoptium (OpenJDK 64-Bit Server VM) --- Office-365-Connector:4.20.2 ace-editor:1.1 allure-jenkins-plugin:2.31.1 analysis-model-api:11.13.0 ansicolor:1.0.4 ant:497.v94e7d9fffa_b_9 antisamy-markup-formatter:162.v0e6ec0fcfcf6 apache-httpcomponents-client-4-api:4.5.14-208.v438351942757 artifactory:3.13.2 authentication-tokens:1.53.v1c90fd9191a_b_ autonomiq:1.22 bitbucket-scm-trait-commit-skip:0.4.0 blueocean:1.27.9 blueocean-autofavorite:1.2.5 blueocean-bitbucket-pipeline:1.27.9 blueocean-commons:1.27.9 blueocean-config:1.27.9 blueocean-core-js:1.27.9 blueocean-dashboard:1.27.9 blueocean-display-url:2.4.2 blueocean-events:1.27.9 blueocean-git-pipeline:1.27.9 blueocean-github-pipeline:1.27.9 blueocean-i18n:1.27.9 blueocean-jira:1.27.9 blueocean-jwt:1.27.9 blueocean-personalization:1.27.9 blueocean-pipeline-api-impl:1.27.9 blueocean-pipeline-editor:1.27.9 blueocean-pipeline-scm-api:1.27.9 blueocean-rest:1.27.9 blueocean-rest-impl:1.27.9 blueocean-web:1.27.9 bootstrap4-api:4.6.0-6 bootstrap5-api:5.3.2-2 bouncycastle-api:2.29 branch-api:2.1128.v717130d4f816 buildtriggerbadge:251.vdf6ef853f3f5 caffeine-api:3.1.8-133.v17b_1ff2e0599 checks-api:2.0.2 cloudbees-bitbucket-branch-source:856.v04c46c86f911 cloudbees-disk-usage-simple:187.v6378d330d1d4 cloudbees-folder:6.858.v898218f3609d command-launcher:107.v773860566e2e commons-httpclient3-api:3.1-3 commons-lang3-api:3.13.0-62.v7d18e55f51e2 commons-text-api:1.11.0-94.v3e1f4a_926e49 config-file-provider:959.vcff671a_4518b_ configuration-as-code:1738.v2d8b_a_b_8a_54b_1 copyartifact:722.v0662a_9b_e22a_c cors-filter:1.1 credentials:1309.v8835d63eb_d8a_ credentials-binding:642.v737c34dea_6c2 custom-tools-plugin:0.8 data-tables-api:1.13.6-5 display-url-api:2.200.vb_9327d658781 docker-commons:439.va_3cb_0a_6a_fb_29 docker-workflow:572.v950f58993843 durable-task:523.va_a_22cf15d5e0 echarts-api:5.4.0-7 email-ext:2.102 embeddable-build-status:412.v09da_db_1dee68 extended-choice-parameter:376.v2e02857547b_a_ favorite:2.4.3 file-operations:177.vd1773063d935 font-awesome-api:6.4.2-1 forensics-api:2.3.0 fortify:22.2.39 git:5.2.1 git-client:4.5.0 git-server:99.va_0826a_b_cdfa_d github:1.37.3.1 github-api:1.316-451.v15738eef3414 github-branch-source:1751.v90e17c48a_6a_c gradle:2.9 handlebars:3.0.8 handy-uri-templates-2-api:2.1.8-22.v77d5b_75e6953 hashicorp-vault-plugin:364.vf5d54b_3dc313 htmlpublisher:1.32 http_request:1.18 instance-identity:185.v303dc7c645f9 ionicons-api:56.v1b_1c8c49374e ivy:2.5 jackson2-api:2.15.3-372.v309620682326 jakarta-activation-api:2.0.1-3 jakarta-mail-api:2.0.1-3 javadoc:243.vb_b_503b_b_45537 javax-activation-api:1.2.0-6 javax-mail-api:1.6.2-9 jaxb:2.3.9-1 jdk-tool:73.vddf737284550 jenkins-design-language:1.27.9 jersey2-api:2.41-133.va_03323b_a_1396 jira:3.11 jjwt-api:0.11.5-77.v646c772fddb_0 jobConfigHistory:1229.v3039470161a_d jquery:1.12.4-1 jquery-detached:1.2.1 jquery3-api:3.7.1-1 jsch:0.2.8-65.v052c39de79b_2 junit:1240.vf9529b_881428 kubernetes:4054.v2da_8e2794884 kubernetes-client-api:6.8.1-224.vd388fca_4db_3b_ kubernetes-credentials:0.11 ldap:711.vb_d1a_491714dc lockable-resources:1185.v0c528656ce04 mailer:463.vedf8358e006b_ matrix-auth:3.1.10 matrix-project:818.v7eb_e657db_924 maven-plugin:3.23 mercurial:1260.vdfb_723cdcc81 metrics:4.2.18-442.v02e107157925 mina-sshd-api-common:2.11.0-86.v836f585d47fa_ mina-sshd-api-core:2.11.0-86.v836f585d47fa_ momentjs:1.1.1 monitoring:1.95.0 msbuild:1.30 mstest:1.0.5 next-build-number:1.8 nodejs:1.6.1 octopusdeploy:4.0.0 okhttp-api:4.11.0-157.v6852a_a_fa_ec11 parameterized-scheduler:255.v73827fcdf618 pipeline-build-step:516.v8ee60a_81c5b_9 pipeline-graph-analysis:202.va_d268e64deb_3 pipeline-groovy-lib:689.veec561a_dee13 pipeline-input-step:477.v339683a_8d55e pipeline-milestone-step:111.v449306f708b_7 pipeline-model-api:2.2150.v4cfd8916915c pipeline-model-declarative-agent:1.1.1 pipeline-model-definition:2.2150.v4cfd8916915c pipeline-model-extensions:2.2150.v4cfd8916915c pipeline-rest-api:2.34 pipeline-stage-step:305.ve96d0205c1c6 pipeline-stage-tags-metadata:2.2150.v4cfd8916915c pipeline-stage-view:2.34 pipeline-utility-steps:2.16.0 plain-credentials:143.v1b_df8b_d3b_e48 plugin-util-api:3.6.0 popper-api:1.16.1-3 popper2-api:2.11.6-4 powershell:2.1 prism-api:1.29.0-8 prometheus:2.3.3 pubsub-light:1.18 rebuild:330.v645b_7df10e2a_ resource-disposer:0.23 reverse-proxy-auth-plugin:1.7.7 robot:3.4.0 rocketchatnotifier:1.5.2 run-condition:1.7 sauce-ondemand:1.212 schedule-build:502.v9379e178e65b_ scm-api:676.v886669a_199a_a_ script-security:1281.v22fb_899df1a_e sidebar-link:2.4.1 snakeyaml-api:2.2-111.vc6598e30cc65 sonar:2.16.1 splunk-devops:1.10.1 sse-gateway:1.26 ssh-agent:346.vda_a_c4f2c8e50 ssh-credentials:308.ve4497b_ccd8f4 sshd:3.312.v1c601b_c83b_0e stashNotifier:1.439.v202358346a_7d structs:325.vcb_307d2a_2782 thinBackup:1.18 timestamper:1.26 token-macro:384.vf35b_f26814ec trilead-api:2.84.v72119de229b_7 uno-choice:2.8.1 variant:60.v7290fc0eb_b_cd warnings-ng:10.5.1 windows-slaves:1.8.1 workflow-aggregator:596.v8c21c963d92d workflow-api:1283.v99c10937efcb_ workflow-basic-steps:1042.ve7b_140c4a_e0c workflow-cps:3806.va_3a_6988277b_2 workflow-cps-global-lib:609.vd95673f149b_b workflow-durable-task-step:1289.v4d3e7b_01546b_ workflow-job:1360.vc6700e3136f5 workflow-multibranch:756.v891d88f2cd46 workflow-scm-step:415.v434365564324 workflow-step-api:639.v6eca_cd8c04a_a_ workflow-support:865.v43e78cc44e0d ws-cleanup:0.45 xray-connector:2.6.1 ```

What Operating System are you using (both controller, and any agents involved in the problem)?

Reproduction steps

  1. Open link to Job Folder e.g. https://jenkins.domain.tld/job/jobname/ or some Job view

Expected Results

Jobs in the folder or view were shown and listed

Actual Results

for some Jobs: image for some views: image

we have around 100 Job Folders, most of them are unaffected of this issue. We've seen this only on a few (7-8 jobs/views) so far.

Anything else?

Are you interested in contributing a fix?

We're open to test any potential fix for this.

kumarkeshav021 commented 9 months ago

@zisuu I am facing the similar issue on folder that have VaultAwsIamCredentials with error 'CannotResolveClassException: currentClientToken' as in latest code currentClientToken field is removed from src/main/java/com/datapipe/jenkins/vault/credentials/AbstractVaultTokenCredentialWithExpiration.java.

reder9 commented 8 months ago

I am facing the same issue after updating to the latest version of the Vault Jenkins plugin [364.vf5d54b_3dc313] where when I go to some folders I cant see any jobs in the folder. I'm also willing to test any potential fixes if needed.

nzechcrashplan commented 8 months ago

Downgrading to a version prior to the above mentioned fixed the issue for us.

vytstank commented 8 months ago

With HashiCorp Vault Plugin Version 364.vf5d54b_3dc313 removing tokenExpiry from job/folder/config.xml and restarting Jenkins allows to enter folder via WebUI

<tokenExpiry>
  <time>1234567890</time>
  <timezone>UTC</timezone>
</tokenExpiry>
xahys commented 8 months ago

In my case i just resolve it injob/folder/config.xml when i add this line

      <hudson.model.AllView>
        <owner class="com.cloudbees.hudson.plugins.folder.Folder" reference="../../../.."/>  <!-- this line-->
        <name>All</name>
        <filterExecutors>false</filterExecutors>

After update to 364.vf5d54b_3dc313 this line has been removed, but if you revert it and restart - you may to resolve problem

jetersen commented 7 months ago

A fix was created: #325 Here's the artifacts if anyone wants to test it out https://repo.jenkins-ci.org/incrementals/com/datapipe/jenkins/plugins/hashicorp-vault-plugin/365.v3eccb_cf44f8f/

vytstank commented 7 months ago

Maybe root cause for my problem is quite different from original message. I can reproduce error with 365.v3eccb_cf44f8f when I have vault config in a folder. Folder config.xml is copied from instance running 363.va_f8c1627db_b_a, stack trace attached.

If I stop Jenkins, remove tokenExpiry from config.xml, start Jenkins, error goes away on 364 and on 365.v3eccb_cf44f8f.

Downgrading to 363.va_f8c1627db_b_a works as expected.

jenkins-log-part.txt

jetersen commented 7 months ago

Ya config.xml would still fail but it should prevent the error from coming back when saving/creating a folder.

What if you create a new folder and see if 365.v3eccb_cf44f8f won't save the tokenExpiry.