Skip to content

Conversation

@mababio
Copy link

@mababio mababio commented Oct 6, 2023

Decided to use Hashicorp Vault Secret manager and spent days trying to read secrets using the hvac python module.

Faced permission issues even though I followed example code:

raise exceptions.VaultError.from_status( hvac.exceptions.Forbidden: 1 error occurred: * permission denied

I created a dev vault cluster managed by Hashicorp. Not sure if the issue exists if Vault cluster was hosted else where.

After specifying namespace in the Client method, I was able to read the secret

Description

Added namespace in the Client method and added a short comment. Also added another minor comment

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

create a Hasicorp Vault managed cluster and attempt to use the example without mentioning namespace in the Client method and see if it fails. if it does, try to mention namespace and see if it passes

@mababio mababio requested a review from a team as a code owner October 6, 2023 06:22
@hashicorp-cla
Copy link

hashicorp-cla commented Oct 6, 2023

CLA assistant check
All committers have signed the CLA.

@mababio
Copy link
Author

mababio commented Oct 14, 2023

@digivava when you get a chance

client = hvac.Client(
url='http://127.0.0.1:8200',
token='dev-only-token',
namespace='admin', # If namespace is configured, make sure to set here

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

think admin namespace is a special child, think we can comment this out?

Suggested change
namespace='admin', # If namespace is configured, make sure to set here
# namespace='admin', # If namespace is configured, make sure to set here

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These examples are used on our Developer Quickstart page, which currently is written to test against a locally running dev Vault server. So the easiest way to not rewrite the whole quickstart doc right now would probably just be to include a comment like this:

# On HCP Vault clusters, all secrets live within a top-level 'admin' namespace. This can be specified with namespace='admin' when initializing the client.
client = hvac.Client(
    url='http://127.0.0.1:8200',
    ...

We will probably want to add that comment to the rest of the language examples as well, not just Python.

@mababio
Copy link
Author

mababio commented Oct 29, 2023

@digivava lgtm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants