Vault - Drone CLI - error.performing.token.check:.failed.to.look.up.namespace.from.the.token:.no.namespace

Drone Support
1

Hello,

I do no manage to integrate Drone w/ Vault. I tried troubleshooting with drone CLI and curl.
Drone CLI gives a “Temporary Redirect” output:

root@37139c1880d7:/# curl -X GET -H "X-Vault-Token:$DRONE_SECRET_SECRET" $DRONE_SECRET_ENDPOINT/v1/secret/data/docker                                   
{"request_id":"bfd8710b-5a7f-9b17-701e-d13f7eab2bb0","lease_id":"","renewable":false,"lease_duration":0,"data":{"data":{"config.json":"{\n  \"auths\": {\n          \"xxx\": {\n                  \"auth\": \"xxx\"\n          }\n  }\n}"},"metadata":{"created_time":"2019-04-27T03:03:07.733328206Z","deletion_time":"","destroyed":false,"version":1}},"wrap_info":null,"warnings":null,"auth":null}
root@37139c1880d7:/# 
root@37139c1880d7:/# 
root@37139c1880d7:/# drone plugins secret get v1/secret/data/docker --repo test/test                                                                   
Temporary Redirect
root@37139c1880d7:/# drone plugins secret get /v1/secret/data/docker --repo test/test
Temporary Redirect

root@37139c1880d7:/# drone plugins secret get secret/data/docker --repo test/test   
Temporary Redirect

Has anybody had to solve this before?

Thanks,
Ionut

2

something looks off … the $DRONE_SECRET_ENDPOING is not the address of your vault server. It is the address of the vault plugin, which is running as a standalone deamon and acts as an adapter between drone and vault.

did you install the plugin as described here:
https://docs.drone.io/extend/secrets/vault/install/

and are you using the plugin address as DRONE_SECRET_ENDPOINT ?

3

Thank you, I got the variables right and re-did the test:

printenv | egrep -i “vault|secret”
VAULT_TOKEN=[ROOT TOKEN VAULT]
DRONE_SECRET_ENDPOINT=http://drone_vault_plugin:3000
VAULT_ADDR=http://vault:8200
DRONE_SECRET_SECRET=[SECRET BTW DRONE AND VAULT PLUGIN]

drone plugins secret get --repo test/test secret/data/docker
secret not found

curl -X GET -H “X-Vault-Token:$VAULT_TOKEN” $VAULT_ADDR/v1/secret/data/docker {“request_id”:"…",“lease_id”:"",“renewable”:false,“lease_duration”:0,“data”:{…},“metadata”:{…}

The Vault plugin says:
time=“2019-04-27T16:31:56Z” level=info msg=“server listening on address :3000”
time=“2019-04-27T16:31:56Z” level=debug msg=“vault: token rereshing disabled”
time=“2019-04-27T16:32:01Z” level=debug msg=“secrets: cannot find secret : secret not found”

I am using the :latest drone/drone and drone/vault

4

Looking further I see the following message in tcpdump

    0x00a0:  3a35 393a 3539 2047 4d54 0d0a 436f 6e74  :59:59.GMT..Cont
    0x00b0:  656e 742d 4c65 6e67 7468 3a20 3130 320d  ent-Length:.102.
    0x00c0:  0a0d 0a7b 2265 7272 6f72 7322 3a5b 2265  ...{"errors":["e
    0x00d0:  7272 6f72 2070 6572 666f 726d 696e 6720  rror.performing.
    0x00e0:  746f 6b65 6e20 6368 6563 6b3a 2066 6169  token.check:.fai
    0x00f0:  6c65 6420 746f 206c 6f6f 6b20 7570 206e  led.to.look.up.n
    0x0100:  616d 6573 7061 6365 2066 726f 6d20 7468  amespace.from.th
    0x0110:  6520 746f 6b65 6e3a 206e 6f20 6e61 6d65  e.token:.no.name
    0x0120:  7370 6163 6522 5d7d 0a                   space"]}.

which seems to be the reason behind “secret not found”

5

You can trace the code here: https://github.com/drone/drone-vault/blob/master/plugin/plugin.go

6

Strange the namespace reference in the error message returned by Vault … I do not use namespaces on Vault side.

I haven’t been able to figure out how comes that the drone cli request does not receive a success answer from Vault.

7

I tested the Drone Vault integration with a fresh Vault installation. The behavior is unchanged.

Could this problem be because of the Drone Vault plugin? I am saying this because the curl GET is successful.
I looked to the Go plugin code, but I am not knowledgeable enough to troubleshoot a Go code.

Has the Drone Vault plugin been QAed with specific Vault version?

Thanks.

8

Unlikely. Drone uses the official Vault library when fetching secrets. There are also teams, including myself, using this in production today without issue.

9

I was asking because:

  • the errors say “namespace” which is a feature available only with Vault Enterprise - I do not have Enterprise version
  • I am using the latest Vault docker image

I am lost in the ecosystem :slight_smile:

10

I could move forward with my troubleshooting:

I added VAULT_API_ADDR to the exported env variables and to the drone vault plugin docker composer:

printenv | egrep -i “vault|secret”
VAULT_TOKEN=[VAULT TOKEN]
SECRET_KEY=558f3eacbfd5928157cbfe34823ab921
DRONE_SECRET_ENDPOINT=http://drone_vault_plugin:3000
VAULT_ADDR=http://vault:8200
DRONE_SECRET_SECRET=558f3eacbfd5928157cbfe34823ab921
VAULT_API_ADDR=http://vault:8200

and the .drone.yml could handle the pull of my container using Vault secret

steps:

  • name: build_package
    image: registry.local.home.p2o.be/aws_lambda_ami
    …

image_pull_secrets:

  • vault_registryprivatehub

kind: secret
name: vault_registryprivatehub
get:
path: secret/data/docker
name: config.json

drone cli is working as expected:
./drone plugins secret get secret/data/test username --repo test/test
test