Vault secrets operator, issues with invalid CR group

Vault
1

I’m seeing this in the log, any idea how to resolve it?

E0711 02:25:56.448952       1 reflector.go:140] pkg/mod/k8s.io/client-
go@v0.26.5/tools/cache/reflector.go:169: Failed to watch *v1beta1.VaultConnection: failed
 to list *v1beta1.VaultConnection: request to convert CR from an invalid group/version: secrets.hashicorp.com/v1alpha1
2

It appears that vault-secrets-operator 0.1.0-rc.1 changed the API version from v1alpha1 to v1beta1 with no allowance for compatibility at all.

So now you would have to delete the old versions of all the VSO-related Kubernetes custom resources from the Kubernetes API server, and recreate them using the new version.

3

Thanks for the response. Yes, I’ve tried recreating these CRDS as still have the issue. Could it be somewhere else? Also I’m using the helm chart. I’ve tried deleting the chart and reinstalling it but it doesn’t help.

kubectl get crds

vaultauths.secrets.hashicorp.com                            2023-07-12T04:21:50Z
vaultconnections.secrets.hashicorp.com                      2023-07-12T04:21:50Z
vaultdynamicsecrets.secrets.hashicorp.com                   2023-07-12T04:21:50Z
vaultpkisecrets.secrets.hashicorp.com                       2023-07-12T04:21:50Z
vaultstaticsecrets.secrets.hashicorp.com                    2023-07-12T04:21:50Z

kubectl describe crd vaultconnections.secrets.hashicorp.com

  Names:
    Kind:       VaultConnection
    List Kind:  VaultConnectionList
    Plural:     vaultconnections
    Singular:   vaultconnection
  Scope:        Namespaced
  Versions:
    Name:  v1beta1
    Schema:
4

I’m not an expert Kubernetes admin, but the it seems something somewhere in your Kubernetes cluster still has leftovers from the v1alpha1 version - it seems you’ll have to investigate, find and delete it.

5

Alright I figured it out. Basically it looks like the install is removing previous CRDs (i.e. alpha1). So if you have any objects with those CRDS you cannot view or delete them after you upgrade the Vault System Operator version.

To fix I had to first delete all my beta1 objects, then remove the helm release and then reinstall the initial version with the alpha crds. Then I could delete the “default” VaultConnection that was causing the issue. I’ll file an issue on Github