Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vault agent overwrites kubernetes managedFields #528

Open
tymofiiparf opened this issue Oct 4, 2023 · 0 comments
Open

Vault agent overwrites kubernetes managedFields #528

tymofiiparf opened this issue Oct 4, 2023 · 0 comments
Labels
bug Something isn't working injector Area: mutating webhook service

Comments

@tymofiiparf
Copy link

Describe the bug
After adding vault injection, on pod with vault side car managedFields are missing.
That is causing pod to stuck in running state, even if node is unavailable. Pod is makred with NodeNotReady, but it seems pod with vault sidecar cannot be removed and replaced.
Applications are running in EKS cluster

To Reproduce
Steps to reproduce the behavior:

  1. Deploy application annotated for vault-agent injection
  2. Drop node, on which pod is running
  3. Pod will stuck in Running state almost forever.

Application deployment:

        vault.hashicorp.com/agent-init-first: 'true'
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-inject-secret-config-application: 
        vault.hashicorp.com/agent-inject-secret-config-common: 
        vault.hashicorp.com/agent-inject-secret-database-creds-mysql-ro: 
        vault.hashicorp.com/agent-inject-secret-database-creds-mysql-rw: 
        vault.hashicorp.com/agent-inject-secret-rabbitmq-creds-ro: 
        vault.hashicorp.com/agent-inject-secret-rabbitmq-creds-rw: 
        vault.hashicorp.com/agent-revoke-on-shutdown: 'true'
        vault.hashicorp.com/auth-config-region: eu-central-1
        vault.hashicorp.com/auth-config-type: iam
        vault.hashicorp.com/auth-path: auth/aws
        vault.hashicorp.com/auth-type: aws
        vault.hashicorp.com/role: 

Expected behavior
When pod is injected with vault sidecar, it should contain managedFields, and recreated when Node is not ready

Environment

  • Kubernetes version:
    • EKS 1.27.3
    • With istio
  • vault-k8s version: hashicorp/vault-k8s:1.3.0 (AGENT_INJECT_VAULT_IMAGE value: hashicorp/vault:1.14.4)
@tymofiiparf tymofiiparf added the bug Something isn't working label Oct 4, 2023
@tvoran tvoran added the injector Area: mutating webhook service label Oct 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working injector Area: mutating webhook service
Projects
None yet
Development

No branches or pull requests

2 participants