{"action":"closed","issue":{"url":"https://api.github.com/repos/concourse/concourse/issues/2981","repository_url":"https://api.github.com/repos/concourse/concourse","labels_url":"https://api.github.com/repos/concourse/concourse/issues/2981/labels{/name}","comments_url":"https://api.github.com/repos/concourse/concourse/issues/2981/comments","events_url":"https://api.github.com/repos/concourse/concourse/issues/2981/events","html_url":"https://github.com/concourse/concourse/issues/2981","id":395403536,"node_id":"MDU6SXNzdWUzOTU0MDM1MzY=","number":2981,"title":"Enabling Kubernetes In Cluster overrides Vault as Credential Manager","user":{"login":"mattlqx","id":739851,"node_id":"MDQ6VXNlcjczOTg1MQ==","avatar_url":"https://avatars0.githubusercontent.com/u/739851?v=4","gravatar_id":"","url":"https://api.github.com/users/mattlqx","html_url":"https://github.com/mattlqx","followers_url":"https://api.github.com/users/mattlqx/followers","following_url":"https://api.github.com/users/mattlqx/following{/other_user}","gists_url":"https://api.github.com/users/mattlqx/gists{/gist_id}","starred_url":"https://api.github.com/users/mattlqx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattlqx/subscriptions","organizations_url":"https://api.github.com/users/mattlqx/orgs","repos_url":"https://api.github.com/users/mattlqx/repos","events_url":"https://api.github.com/users/mattlqx/events{/privacy}","received_events_url":"https://api.github.com/users/mattlqx/received_events","type":"User","site_admin":false},"labels":[{"id":659553454,"node_id":"MDU6TGFiZWw2NTk1NTM0NTQ=","url":"https://api.github.com/repos/concourse/concourse/labels/stack/kubernetes","name":"stack/kubernetes","color":"3c75ee","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-01-02T22:36:35Z","updated_at":"2019-01-03T17:06:53Z","closed_at":"2019-01-03T17:06:52Z","author_association":"NONE","body":"## Bug Report\r\n\r\nRunning Concourse with `CONCOURSE_KUBERNETES_IN_CLUSTER=true` seems to take precedence as using it for a credentials manager instead of whatever other ones are configured (in my case, Vault).\r\n\r\n## Steps to Reproduce\r\n\r\nConfigure Concourse web with Vault and `CONCOURSE_KUBERNETES_IN_CLUSTER=true`.\r\n\r\n## Expected Results\r\n\r\nReferenced credentials via `((mysecret.mykey))` to successfully be fetched from Vault and used.\r\n\r\n## Actual Results\r\n\r\nReferenced credential tries to pull from Kubernetes secret. These log lines are from prior to adding a Role so that concourse's ServiceAccount can access secrets in the namespace.\r\n\r\n```\r\n{\"timestamp\":\"1546464374.246833086\",\"source\":\"atc\",\"message\":\"atc.syncer.mypipeline:radar.scan-resource.interval-runner.tick.failed-to-evaluate-resource-source\",\"log_level\":2,\"data\":{\"error\":\"Finding variable 'github.private_key': secrets \\\"mypipeline.github\\\" is forbidden: User \\\"system:serviceaccount:concourse:default\\\" cannot get resource \\\"secrets\\\" in API group \\\"\\\" in the namespace \\\"concourse-main\\\"\",\"pipeline-scoped-name\":\"mypipeline:resource:concourse\",\"session\":\"20.1.99.1.1\"}}\r\n{\"timestamp\":\"1546464374.250164747\",\"source\":\"atc\",\"message\":\"atc.syncer.mypipeline:radar.scanresources-runner-error\",\"log_level\":1,\"data\":{\"error\":{\"Err\":{},\"Cause\":{\"ErrStatus\":{\"metadata\":{},\"status\":\"Failure\",\"message\":\"secrets \\\"mypipeline.github\\\" is forbidden: User \\\"system:serviceaccount:concourse:default\\\" cannot get resource \\\"secrets\\\" in API group \\\"\\\" in the namespace \\\"concourse-main\\\"\",\"reason\":\"Forbidden\",\"details\":{\"name\":\"mypipeline.github\",\"kind\":\"secrets\"},\"code\":403}}},\"session\":\"20.1\"}}\r\n{\"timestamp\":\"1546464374.259128571\",\"source\":\"atc\",\"message\":\"atc.credential-manager.k8s-secret-error\",\"log_level\":2,\"data\":{\"error\":\"secrets \\\"mypipeline.github\\\" is forbidden: User \\\"system:serviceaccount:concourse:default\\\" cannot get resource \\\"secrets\\\" in API group \\\"\\\" in the namespace \\\"concourse-main\\\"\",\"name\":\"kubernetes\",\"namespace\":\"concourse-main\",\"pipelineSecretName\":\"mypipeline.github\",\"secretName\":\"github\",\"session\":\"17\"}}\r\n```\r\n\r\nAfter adding the Role, it simply says it can't find an non-existing secret.\r\n\r\n```\r\n{\"timestamp\":\"1546466294.253921509\",\"source\":\"atc\",\"message\":\"atc.credential-manager.k8s-secret-not-found\",\"log_level\":1,\"data\":{\"name\":\"kubernetes\",\"namespace\":\"concourse-main\",\"pipelineSecretName\":\"mypipeline.github\",\"secretName\":\"github\",\"session\":\"17\"}}\r\n```\r\n\r\nI can set `CONCOURSE_KUBERNETES_IN_CLUSTER=false` and the credential pulls from Vault successfully.\r\n\r\n## Additional Context\r\n\r\nI don't see any documentation about the Kubernetes integrations of Concourse and I'm a new user to Concourse. It runs out of my Kubernetes cluster right now but I don't want to use it as a credentials manager. I'm unsure if setting `CONCOURSE_KUBERNETES_IN_CLUSTER` gives me additional features beyond that.\r\n\r\n## Version Info\r\n\r\n* Concourse version: 4.2.2\r\n* Deployment type (BOSH/Docker/binary):\r\n* Infrastructure/IaaS:\r\n* Browser (if applicable):\r\n* Did this used to work?\r\n"}}
{"actor":{"display_login":"vito"}}