-
Notifications
You must be signed in to change notification settings - Fork 187
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ArgoCD Vault Plugin loses connection to Vault #614
Comments
In general, it seems as if the problem was not timeout, but ServiceAccount Let's say we have two applications: A secret is generated for each of them, which allows to go to Vault. Example with
The
Pod So when we used a universal role that has access to all secrets, we didn't encounter this problem |
We are seeing a similar issue as we have a similar setup. We have actually troubleshooted inside the avp-helm (in our case) sidecar container that we are using as part of the repo-server. It seems to us, that when using different AppRoles within the same sidecar, there is an issue with the token caching. The concept is briefly discussed here: https://argocd-vault-plugin.readthedocs.io/en/stable/usage/#caching-the-hashicorp-vault-token We believe, that there is a race-condition, whoever comes first to refresh a token (default lifetime is 20min), gets to execute. This gets a bit of additional randomness from having two repo-server instances and two sidecars therefore at the same time. This is further supported by our discovery that this never happens for our second sidecar with avp that always uses the same secret and that we can always reproduce this by running a hard refresh for all of our applications (we are using 10+ different AppRoles in our case). |
Describe the bug
Periodically the plugin loses connection to Vault. In this way, after configuration the plugin works correctly, but after 15-20 minutes the connection is lost. Hard Refresh of the app does not help. However, If you restart
argocd-repo-server
andargocd-redis
, everything works successfully. If you restart one of them, the problem does not solve.I use Multitenancy with Kubernetes Authentication
To Reproduce
If you want to reproduce this, you will need the following:
argocd-policy
argocd-role
, specifying the parametersExpected behavior
If you configure a connection to Vault for an application once, the connection will work stably.
Screenshots/Verbose output
Example of output
Additional context
If you don't use Multitenancy, but make the most insecure policy possible, the connection is stable.
The text was updated successfully, but these errors were encountered: