hashicorp-vault-plugin icon indicating copy to clipboard operation
hashicorp-vault-plugin copied to clipboard

`AbstractVaultTokenCredentialWithExpiration` is broken for multi-cluster setup

Open dee-kryvenko opened this issue 1 year ago • 1 comments

Jenkins and plugins versions report

Latest

What Operating System are you using (both controller, and any agents involved in the problem)?

CentOS

Reproduction steps

Run

withVault(configuration: [
    "vaultCredentialId": "vault-aws-iam-role",
    "vaultUrl": "https://foo"
    ], vaultSecrets: [[
        "path": "secret/test",
        "secretValues": [[
            "envVar": "SECRET",
            "vaultKey": "foo"
        ]]
    ]]) {
    echo SECRET
}
withVault(configuration: [
    "vaultCredentialId": "vault-aws-iam-role",
    "vaultUrl": "https://bar"
    ], vaultSecrets: [[
        "path": "secret/test",
        "secretValues": [[
            "envVar": "SECRET",
            "vaultKey": "foo"
        ]]
    ]]) {
    echo SECRET
}

Expected Results

Should use and cache separate tokens

Actual Results

It is issuing and caching a token for https://foo and then until this token expires - it tries to use that token for https://bar as well as any other Vault cluster, and it obviously gets 403 in response.

Anything else?

No response

dee-kryvenko avatar Oct 04 '22 21:10 dee-kryvenko