hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.

Home Page:https://hashicorp.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Upgrading to 0.5.0 and trying to use transformation results in error: unknown field "spec.destination.transformation"

imranzunzani opened this issue · comments

Describe the bug
Upgraded the installation to use transformation with

helm upgrade --install vault-secrets-operator hashicorp/vault-secrets-operator -n vault-secrets-operator-system --values vault/required-values.yaml --version 0.5.0

Then tried applying a static secret with transformation, but it keeps resulting in error:

Error from server (BadRequest): error when creating "vault/static-secrets-templated2.yaml": VaultStaticSecret in version "v1beta1" cannot be handled as a VaultStaticSecret: strict decoding error: unknown field "spec.destination.transformation"

To Reproduce
Steps to reproduce the behavior:

  1. Upgrade or install fresh the vso with Helm
  2. Apply a VaultStaticSecret with transformation

static-secrets-templated2.yaml (taken from example in the PR: #437)

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: vso-secret
  namespace: vault-secrets-operator
spec:
  destination:
    create: true
    name: vso-secret
    transformation:
      excludes:
        - .*
      templates:
        users:
          text: |-
             {{- range $value := .Secrets }}
             {{- printf "%s\n" $value  -}}
             {{- end -}}
  hmacSecretData: true
  mount: kv
  path: k8s/lab/adamtest
  refreshAfter: 5s
  type: kv-v2
  vaultAuthRef: vaultauth-test

Expected behavior
transformation should not get reported as unknown field.

Environment

  • Kubernetes version: GKE - 1.26.12-gke.1111000
  • vault-secrets-operator version: 0.5.0

Additional context
I get the warning about the schema in cloud code as well. Please see the screenshot:
Screenshot 2024-02-20 at 19 27 39

Hi @imranzunzani, it looks like your CRDs were not updated. Unfortunately, helm does not take care of the update for you, so it is a manual step. Please take a look at https://developer.hashicorp.com/vault/docs/platform/k8s/vso/installation#updating-crds-when-using-helm for more details.

Thanks,

Ben

Hi @benashz ,
Thank you for the quick response. This resolves the unknown field error.