-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Using Hashicorp Vault secrets with TriggerAuthentication results in unable to convert Vault Data value error #2645
Comments
I am not Haschicorp Vault expert, but seems like it hasn't been able to properly parse keda/pkg/scaling/resolver/scale_resolvers.go Lines 450 to 454 in 6e8e195
|
@chapurlatn @nisan270390 would you mind looking at this? Thanks |
Some additional debugging. Added this above pkg/scaling/resolver/scale_resolvers.go#L205
Results in log output.
Added debug code above this line pkg/scaling/resolver/scale_resolvers.go#L450 Results in log output.
Thanks. |
Hm for some reason the keda/pkg/scaling/resolver/scale_resolvers.go Line 450 in 18428b2
The |
We bumped
By chance could you please try some older KEDA versions (2.5/2.4) so we can be sure that it is not a regression ? |
Test results Got the same error using the
|
After some additional investigation. It seems this code here expects one to have created the vault secret using the vault go sdk. Using this code the secret added using
Output executing the above code
|
Sorry left out what the data looks like in vault
Using vault cli
|
@chaunceyt oh that's really awful 🤦♂️ Great investigation! Could you please open a PR with a fix? To support both approaches based on what is in the key & value? To check what is the key and what is the value (whether a map or value) etc. |
@chaunceyt Isn't that just because when you added the secret via the vault go sdk you explicitly added a "data" wrapper around the actual secret, whereas via the CLI you didn't (and it doesn't). The resolving code is then expecting that "data" wrapper - which was artificially added via the go sdk write. Wouldn't you have identical results if you had just written the secret (rather than wrap in a "data" map), i.e.
And then remove the "data" lookup from the secret resolving code:
Unless I am misreading it all |
After some additional investigation. This issue is centered around I was able to get
|
I am glad it has been resolved. |
@chaunceyt any update on the PR? |
@zroubalik Sorry for the delay got busy on a different project, I should have the PR in a couple of days. |
Signed-off-by: Chauncey Thorn <chaunceyt@gmail.com>
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions. |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions. |
This issue has been automatically closed due to inactivity. |
Hi Guys , I have done the changes in the keda/pkg/scaling/resolver/scale_resolvers.go
But still no luck . I am using enterprise vault with kv1 . Could some help here ? Error: 1.6764615272404535e+09 INFO controller.scaledobject Creating a new HPA {"reconciler group": "keda.sh", "reconciler kind": "ScaledObject", "name": "kafka-scaledobject", "namespace": "carbon-health-ns", "HPA.Namespace": "carbon-health-ns", "HPA.Name": "keda-hpa-kafka-scaledobject"} |
Report
Configuring a
TriggerAuthentication
object to usehashiCorpVault
to get the values for various parameters on a ScaledObject. The scale_resolvers returnsunable to convert Vault Data value
Expected Behavior
The result of the
queryKey
to be used for thenew-relic
scalerActual Behavior
The following error related to the
new-relic
scalerSteps to Reproduce the Problem
kind create cluster --name keda-test
kubectl create namespace keda
helm install keda kedacore/keda --namespace keda
vault server -dev -dev-root-token-id="root" -dev-listen-address=0.0.0.0:8200 >> /dev/null &
export VAULT_ADDR='http://0.0.0.0:8200'
vault login root
export VAULT_SA_NAME=$(kubectl get sa keda-operator -n keda --output jsonpath="{.secrets[*]['name']}")
export SA_JWT_TOKEN=$(kubectl get secret -n keda $VAULT_SA_NAME --output 'go-template={{ .data.token }}' | base64 --decode)
export SA_CA_CRT=$(kubectl config view --raw --minify --flatten --output 'jsonpath={.clusters[].cluster.certificate-authority-data}' | base64 --decode)
export K8S_HOST=$(kubectl config view --raw --minify --flatten --output 'jsonpath={.clusters[].cluster.server}')
vault auth enable kubernetes
triggerauthentication.yaml
scaledobject.yaml
deployment.yaml
kubectl create ns keda-test
kubectl apply -f deployment.yaml -n keda-test
kubectl apply -f triggerauthentication.yaml -n keda-test
kubectl apply -f scaledobject.yaml -n keda-test
stern
orkubectl logs
Logs from KEDA operator
KEDA Version
2.6.0
Kubernetes Version
v1.21.1
Platform
Other
Scaler Details
Anything else?
Create Vault v1 secret
vault secrets enable -path="kv-v1" -description="Test V1" kv
Added NR key
vault kv put kv-v1/keda/secret keda-nr-key=NRAK-12345678901234
Also tested using a v2 and got same error.
The text was updated successfully, but these errors were encountered: