-
Notifications
You must be signed in to change notification settings - Fork 187
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
tls: failed to verify certificate: x509 while connecting to Delinea Secret Server #602
Comments
I also tried running the command directly.But still the same result.There is no way I can pass the CACERT.It is setting the VAULT_CACERT and VAULT_CAPATH .But I believe that is for the Hashicorp Vault not for Delinea argocd-vault-plugin generate -s thycotic-poc:avp-delinea-backend-secret 2024/01/31 07:44:36 reading configuration from secret thycotic-poc:avp-delinea-backend-secret 2024/01/31 07:44:36 avp_delinea_url: https://[xx-thycotic.abc.local/SecretServer] [ERROR] grant response error:Post "https://xx-thycotic.abc.local/SecretServer/oauth2/token": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead |
Got it working by building a separate image |
According to this issue: argoproj-labs/argocd-vault-plugin#602 (comment).
Describe the bug
While connecting to Delinea Secret Server there is no parameter to specify CA certificate. official document
does not have such kind of parameter mentioned.
To Reproduce
Steps to reproduce the behavior:
Create a secret with the following data
stringData:
AVP_TYPE: delineasecretserver
AVP_DELINEA_URL: https://xx-thycotic.abc.local/SecretServer
AVP_DELINEA_USER: admin
AVP_DELINEA_PASSWORD: xxxxxxxx
AVP_DELINEA_DOMAIN: local
Tried the following combination
VAULT_CACERT: /etc/pki/tls/certs/ca-bundle.crt
CACERT: /etc/pki/tls/certs/ca-bundle.crt
AVP_DELINEA_CACERT: /etc/pki/tls/certs/ca-bundle.crt
CA certificate is mounted to /etc/pki/tls/certs/ca-bundle.crt
Create the application. Following logs are displayed in the pod
error generating manifests in cmp: rpc error: code = Unknown desc = error generating manifests:
sh -c \"helm template $ARGOCD_APP_NAME --include-crds -n $ARGOCD_APP_NAMESPACE ${ARGOCD_ENV_HELM_ARGS} . |\\nargocd-vault-plugin generate --verbose-sensitive-output -\\n\"
failed exit status 1: 2024/01/29 17:27:32 reading configuration from environment, overriding any previous settings[ERROR] grant response error:Post " https://xx-thycotic.abc.local/SecretServer/oauth2/token\": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead\n2024/01/29
[ERROR] error getting accessToken:Post "https://xx-thycotic.abc.local/SecretServer/oauth2/token\": tls: failed to verify certi...
API_USERNAME=admin
API_PASSWORD=xxxxxxxx
SECRETID_ACCESS=522
requestBody="username=$API_USERNAME&password=$API_PASSWORD&grant_type=password"
PAM_URL=https://xx-thycotic.abc.local/SecretServer
apiUrl=$PAM_URL/api/v1/secrets/$SECRETID_ACCESS/fields/Password
pamUrl=$PAM_URL/oauth2/token
curl -s -X POST -H "Accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -d $requestBody $pamUrl
{"access_token":"AgKO8......","token_type":"bearer","expires_in":28800,"refresh_token":"vof...."}
The text was updated successfully, but these errors were encountered: