Comments (9)
Thanks for the quick response.
[2019-01-29 16:19:51,389] WARN - .agent.VaultParametersResolver - Failed to fetch data for path '/de/prod/model-deployer'
org.springframework.vault.VaultException: Status 403 de/prod/model-deployer: permission denied; nested exception is org.springframework.web.client.HttpClientErrorException: 403 Forbidden
at org.jetbrains.teamcity.vault.support.VaultResponses.buildException(VaultResponses.java:82)
at org.jetbrains.teamcity.vault.support.VaultTemplate$3.doWithRestOperations(VaultTemplate.java:180)
at org.jetbrains.teamcity.vault.support.VaultTemplate.doWithSession(VaultTemplate.java:159)
at org.jetbrains.teamcity.vault.support.VaultTemplate.doRead(VaultTemplate.java:167)
at org.jetbrains.teamcity.vault.support.VaultTemplate.read(VaultTemplate.java:128)
at org.jetbrains.teamcity.vault.agent.VaultParametersResolver$VaultParametersFetcher.fetch(VaultParametersResolver.kt:94)
at org.jetbrains.teamcity.vault.agent.VaultParametersResolver$VaultParametersFetcher.doFetchAndPrepareReplacements(VaultParametersResolver.kt:82)
at org.jetbrains.teamcity.vault.agent.VaultParametersResolver.doFetchAndPrepareReplacements(VaultParametersResolver.kt:74)
at org.jetbrains.teamcity.vault.agent.VaultParametersResolver.doFetchAndPrepareReplacements(VaultParametersResolver.kt:70)
at org.jetbrains.teamcity.vault.agent.VaultParametersResolver.resolve(VaultParametersResolver.kt:51)
at org.jetbrains.teamcity.vault.agent.VaultBuildFeature$buildStarted$$inlined$forEach$lambda$1.invoke(VaultBuildFeature.kt:136)
at org.jetbrains.teamcity.vault.agent.VaultBuildFeature$buildStarted$$inlined$forEach$lambda$1.invoke(VaultBuildFeature.kt:33)
at org.jetbrains.teamcity.vault.UtilKt.activity(util.kt:155)
at org.jetbrains.teamcity.vault.agent.VaultBuildFeature.buildStarted(VaultBuildFeature.kt:79)
at sun.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at jetbrains.buildServer.util.EventDispatcher$3.run(EventDispatcher.java:126)
at jetbrains.buildServer.util.NamedThreadFactory.executeWithNewThreadName(NamedThreadFactory.java:76)
at jetbrains.buildServer.util.EventDispatcher.dispatch(EventDispatcher.java:120)
at jetbrains.buildServer.util.EventDispatcher$2.invoke(EventDispatcher.java:70)
at com.sun.proxy.$Proxy7.buildStarted(Unknown Source)
at jetbrains.buildServer.agent.impl.buildStages.startStages.FireBuildStartedStage.doBuildState(FireBuildStartedStage.java:20)
at jetbrains.buildServer.agent.impl.buildStages.startStages.FireEventStageBase.doBuildStage(FireEventStageBase.java:26)
at jetbrains.buildServer.agent.impl.buildStages.BuildStagesExecutor$1.callStage(BuildStagesExecutor.java:31)
at jetbrains.buildServer.agent.impl.buildStages.BuildStagesExecutor$1.callStage(BuildStagesExecutor.java:24)
at jetbrains.buildServer.agent.impl.buildStages.StagesExecutor.callRunStage(StagesExecutor.java:78)
at jetbrains.buildServer.agent.impl.buildStages.StagesExecutor.doStages(StagesExecutor.java:37)
at jetbrains.buildServer.agent.impl.buildStages.BuildStagesExecutor.doStages(BuildStagesExecutor.java:24)
at jetbrains.buildServer.agent.impl.BuildRunActionImpl.doStages(BuildRunActionImpl.java:75)
at jetbrains.buildServer.agent.impl.BuildRunActionImpl.runBuild(BuildRunActionImpl.java:55)
at jetbrains.buildServer.agent.impl.BuildAgentImpl.doActualBuild(BuildAgentImpl.java:300)
at jetbrains.buildServer.agent.impl.BuildAgentImpl.access$100(BuildAgentImpl.java:54)
at jetbrains.buildServer.agent.impl.BuildAgentImpl$1.run(BuildAgentImpl.java:264)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.springframework.web.client.HttpClientErrorException: 403 Forbidden
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:641)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:597)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:557)
at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:264)
at org.jetbrains.teamcity.vault.support.VaultTemplate$3.doWithRestOperations(VaultTemplate.java:173)
... 33 more
[2019-01-29 16:19:51,389] WARN - .agent.VaultParametersResolver - Cannot resolve '/de/prod/model-deployer!/model-deployer-access-key': data wasn't received from HashiCorp Vault
[2019-01-29 16:19:51,390] WARN - .agent.VaultParametersResolver - Cannot resolve '/de/prod/model-deployer!/model-deployer-secret-key': data wasn't received from HashiCorp Vault
from teamcity-hashicorp-vault-plugin.
For anyone with a similar problem, a workaround I found was to create a new vault connection with a different namespace for every secret I wanted to access.
from teamcity-hashicorp-vault-plugin.
Please find corresponding lines in agent's teamcity-agent.log log file and post them here. There would be some stacktrace with detailed error message.
from teamcity-hashicorp-vault-plugin.
Also, I'm not sure if this is related, but in teamcity-server.log, with the default policy applied for the approle, I get this error:
[2019-01-29 16:11:42,078] WARN - ty.vault.server.VaultConnector - Failed to revoke token: org.springframework.web.client.HttpClientErrorException: 403 Forbidden (enable debug to see stacktrace)
When I added
path "auth/token/revoke-accessor" {
capabilities = ["read", "list", "create", "update"]
}
to the policy, the error changed to
[2019-01-29 16:19:52,302] WARN - ty.vault.server.VaultConnector - Failed to revoke token: org.springframework.web.client.HttpClientErrorException: 400 Bad Request (enable debug to see stacktrace)
from teamcity-hashicorp-vault-plugin.
@VladRassokhin Any answers?
from teamcity-hashicorp-vault-plugin.
For anyone with a similar problem, a workaround I found was to create a new vault connection with a different namespace for every secret I wanted to access.
Hi @rcohenDBRS, I have same issue.
I am trying to read one secret for test purpose but the property within the build script appears as a single string like %password%
. Parameter namespace not empty in this scenario.
Without parameter namespace I get 403 error message within client log plus Failed to revoke token within server log.
@VladRassokhin any idea for this issue due to looks like it is not an unique problem.
Edit
I have managed it and it works now. Would be really beneficial if someone could update the documentation!
from teamcity-hashicorp-vault-plugin.
@realrill What did you manage?
from teamcity-hashicorp-vault-plugin.
@rcohenDBRS Reading (multiple) secrets, but only with your solution.
I have had incorrect parameter, that was the source of my issue.
from teamcity-hashicorp-vault-plugin.
same here. Can someone please explain the workaround in more detailed ways?
from teamcity-hashicorp-vault-plugin.
Related Issues (20)
- Parsing GCP private keys - Whitespace issue?
- Connection to trusted https URL fails with "PKIX path building failed" if trusted SSL certificate is configured
- Can't set password for uploaded SSH key HOT 1
- TeamCity Enterprise 2021.1 (build 92597) HOT 1
- error when trying to connect to vault via IAM
- Support for LDAP authentication
- Pass Vault token to build steps as a parameter HOT 2
- Retry request to Vault if it fails because of network connection HOT 2
- Add ability to set the unwrap timeout up
- Configurable ldap auth mount path HOT 2
- Fetch client_id AND client_secret from Azure Secret backend
- Vault token is shown in plaintext in build parameters after the build.
- Feature Request: support mTLS authentication
- Failure on agent side of the plugin(Class 'org.springframework.core.log.LogDelegateFactory' was not found)
- java.lang.LinkageError and java.lang.NoClassDefFoundError when testing IAM connection HOT 1
- IAM authentication does not allow header_value and role to be configured
- Error when trying to connect to Vault via LDAP HOT 4
- Unable to fetch secrets from vault HOT 1
- Increasing connect timeout
- approle unwrap POST ignores build agent http proxy settings HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from teamcity-hashicorp-vault-plugin.