Getting service account name not authorized when using kubernetes as auth type

[eshaingle]

Hello,
I am integration airflow with vault using the vault backend provided under airflow.contrib.secrets.hashicorp_vault.VaultBackend or airflow.providers.hashicorp.secrets.vault.VaultBackend

When I try to provide the kwargs for kubernetes like role, jwt path and retrieve the vault secrets, I am getting below error
File "/home/airflow/.local/lib/python3.6/site-packages/hvac/utils.py", line 47, in raise_for_error raise exceptions.InternalServerError(message, errors=errors, method=method, url=url) hvac.exceptions.InternalServerError: service account name not authorized, on post http://${VAULT_ADDR}/v1/auth/kubernetes/login

I tried to execute a kubernetes pod using KubernetesPodOperator by providing service account, jwt etc, I get the client_token but however when I try to read the vault secret using it, I get same error as above.

Has anybody tested the VaultBackend using kubernetes as auth type to read vault secret? Please let me know, how to proceed further with testing here.

[kaxil]

Can you try with Backport Packages:

https://github.com/apache/airflow/blob/master/airflow/providers/hashicorp/BACKPORT_PROVIDER_README.md

You can install it via:

pip install apache-airflow-backport-providers-hashicorp

Recently many auth_types were added for Vault:

• https://airflow.readthedocs.io/en/latest/_api/hashicorp/secrets/vault/index.html?highlight=Vault
• https://airflow.readthedocs.io/en/latest/_api/hashicorp/hooks/vault/index.html?highlight=Vault

[eshaingle]

Hi, Thank you @kaxil for your reply. Yes I installed above package in the helm chart along with hvac. So when airflow is up, it supports them.
I installed vault and airflow in minikube.

Then through DAG file using KubernetesPodOperator, I simply run a pod to execute below curl :

passing = KubernetesPodOperator(namespace='default', service_account_name="vault-auth", image="alpine:3.7", cmds=["sh", "-cx"], arguments=["apk add curl && curl --request POST \ --data '{"'"jwt"'": "'"$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"'", "'"role"'": "'"example"'"}' \ http://${VAULT_ADDR}/v1/auth/kubernetes/login "], labels={"test-airflow": "firstversion"}, name="passing-test", task_id="passing-task", get_logs=True, dag=dag )

I received the required output with vault token as client_token.

I tried to connect vault through 2 methods. First using default token as auth type and passing above received token

os.environ['AIRFLOW__SECRETS__BACKEND'] = "airflow.providers.hashicorp.secrets.vault.VaultBackend"
os.environ['AIRFLOW__SECRETS__BACKEND_KWARGS'] = '{"connections_path": "myapp", "mount_point": "secret", "auth_type": "token", "token": "$TOKEN", "url": "http://127.0.0.1:8200"}' ```

And second using kubernetes as auth type. But for both it gives same error.
```os.environ['AIRFLOW__SECRETS__BACKEND'] = "airflow.providers.hashicorp.secrets.vault.VaultBackend"
os.environ['AIRFLOW__SECRETS__BACKEND_KWARGS'] = '{"connections_path": "myapp", "auth_mount_point": "kubernetes", "mount_point": "secret", "auth_type": "kubernetes", "kubernetes_role": "example", "kubernetes_jwt_path":"/var/run/secrets/kubernetes.io/serviceaccount/token", "url": "http://${VAULT_ADDR}"}'

Error:
File "/home/airflow/.local/lib/python3.6/site-packages/hvac/utils.py", line 47, in raise_for_error raise exceptions.InternalServerError(message, errors=errors, method=method, url=url) hvac.exceptions.InternalServerError: service account name not authorized, on post http://${VAULT_ADDR}/v1/auth/kubernetes/login

[eshaingle]

Any update or suggestion on how to achieve this?