plugin fails to retrieve secrets with a 403 response from vault since 1.6

[oferziss]

since 1.6 i started getting permissions denied from vault when using VAULT_TOKEN, once i reverted back to 1.5 works well....

• [2.150.3 ] Jenkins version
• [1.6] Plugin version
• [docker jenkinsci:lts ] OS

[oferziss]

adding snippet with log output, might be related to engine version not being specified to Vault instance constructor

Feb 21, 2019 7:58:01 AM io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator tryConstructor
INFO: Setting class com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey.username = <****>
Constructing a Vault instance with no provided Engine version, defaulting to version 2.
Feb 21, 2019 7:58:01 AM io.jenkins.plugins.casc.impl.secrets.VaultSecretSource <init>
WARNING: Unable to connect to Vault
com.bettercloud.vault.VaultException: Vault responded with HTTP status code: 403
Response body: {"errors":["1 error occurred:\n\t* permission denied\n\n"]}

	at com.bettercloud.vault.api.Logical.read(Logical.java:98)
	at com.bettercloud.vault.api.Logical.read(Logical.java:74)
	at io.jenkins.plugins.casc.impl.secrets.VaultSecretSource.<init>(VaultSecretSource.java:80)
	at io.jenkins.plugins.casc.impl.secrets.VaultSecretSource$$FastClassByGuice$$760743d6.newInstance(<generated>)
	at com.google.inject.internal.cglib.reflect.$FastConstructor.newInstance(FastConstructor.java:40)
	at com.google.inject.internal.DefaultConstructionProxyFactory$1.newInstance(DefaultConstructionProxyFactory.java:61)
	at com.google.inject.internal.ConstructorInjector.provision(ConstructorInjector.java:105)
	at com.google.inject.internal.ConstructorInjector.access$000(ConstructorInjector.java:32)
	at com.google.inject.internal.ConstructorInjector$1.call(ConstructorInjector.java:89)
	at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision(ProvisionListenerStackCallback.java:115)
	at hudson.ExtensionFinder$GuiceFinder$SezpozModule.onProvision(ExtensionFinder.java:567)
	at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision(ProvisionListenerStackCallback.java:126)
	at com.google.inject.internal.ProvisionListenerStackCallback.provision(ProvisionListenerStackCallback.java:68)
	at com.google.inject.internal.ConstructorInjector.construct(ConstructorInjector.java:87)
	at com.google.inject.internal.ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:267)
	at com.google.inject.internal.ProviderToInternalFactoryAdapter$1.call(ProviderToInternalFactoryAdapter.java:46)
	at com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1103)
	at com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
	at com.google.inject.internal.SingletonScope$1.get(SingletonScope.java:145)
	at hudson.ExtensionFinder$GuiceFinder$FaultTolerantScope$1.get(ExtensionFinder.java:440)
	at com.google.inject.internal.InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:41)
	at com.google.inject.internal.InjectorImpl$2$1.call(InjectorImpl.java:1016)
	at com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1092)
	at com.google.inject.internal.InjectorImpl$2.get(InjectorImpl.java:1012)
	at hudson.ExtensionFinder$GuiceFinder._find(ExtensionFinder.java:402)
	at hudson.ExtensionFinder$GuiceFinder.find(ExtensionFinder.java:393)
	at hudson.ClassicPluginStrategy.findComponents(ClassicPluginStrategy.java:494)
	at hudson.ExtensionList.load(ExtensionList.java:380)
	at hudson.ExtensionList.ensureLoaded(ExtensionList.java:318)
	at hudson.ExtensionList.size(ExtensionList.java:191)
	at java.util.AbstractCollection.toArray(AbstractCollection.java:136)
	at java.util.ArrayList.addAll(ArrayList.java:581)
	at io.jenkins.plugins.casc.SecretSource.all(SecretSource.java:24)
	at io.jenkins.plugins.casc.ConfigurationContext.getSecretSources(ConfigurationContext.java:100)
	at io.jenkins.plugins.casc.SecretSourceResolver.reveal(SecretSourceResolver.java:35)
	at io.jenkins.plugins.casc.SecretSourceResolver.handle(SecretSourceResolver.java:28)
	at io.jenkins.plugins.casc.SecretSourceResolver.lambda$interpolator$0(SecretSourceResolver.java:22)
	at org.bigtesting.interpolatd.core.SubstitutionHandlerImpl.interpolate(SubstitutionHandlerImpl.java:52)
	at org.bigtesting.interpolatd.core.InterpolationHandlerImpl.interpolate(InterpolationHandlerImpl.java:69)
	at org.bigtesting.interpolatd.Interpolator.interpolate(Interpolator.java:59)
	at io.jenkins.plugins.casc.SecretSourceResolver.resolve(SecretSourceResolver.java:17)
	at io.jenkins.plugins.casc.impl.configurators.PrimitiveConfigurator.configure(PrimitiveConfigurator.java:46)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.tryConstructor(DataBoundConfigurator.java:130)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.instance(DataBoundConfigurator.java:73)
	at io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:264)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.configure(DataBoundConfigurator.java:79)
	at io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configure(HeteroDescribableConfigurator.java:96)
	at io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configure(HeteroDescribableConfigurator.java:43)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.tryConstructor(DataBoundConfigurator.java:130)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.instance(DataBoundConfigurator.java:73)
	at io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:264)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.configure(DataBoundConfigurator.java:79)
	at io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configure(HeteroDescribableConfigurator.java:96)
	at io.jenkins.plugins.casc.impl.configurators.HeteroDescribableConfigurator.configure(HeteroDescribableConfigurator.java:43)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.tryConstructor(DataBoundConfigurator.java:122)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.instance(DataBoundConfigurator.java:73)
	at io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:264)
	at io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.check(DataBoundConfigurator.java:97)
	at io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:341)
	at io.jenkins.plugins.casc.BaseConfigurator.check(BaseConfigurator.java:284)
	at io.jenkins.plugins.casc.BaseConfigurator.configure(BaseConfigurator.java:349)
	at io.jenkins.plugins.casc.BaseConfigurator.check(BaseConfigurator.java:284)
	at io.jenkins.plugins.casc.ConfigurationAsCode.lambda$checkWith$8(ConfigurationAsCode.java:657)
	at io.jenkins.plugins.casc.ConfigurationAsCode.invokeWith(ConfigurationAsCode.java:620)
	at io.jenkins.plugins.casc.ConfigurationAsCode.checkWith(ConfigurationAsCode.java:657)
	at io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:642)
	at io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:545)
	at io.jenkins.plugins.casc.ConfigurationAsCode.configure(ConfigurationAsCode.java:275)
	at io.jenkins.plugins.casc.ConfigurationAsCode.init(ConfigurationAsCode.java:267)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:104)
	at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:175)
	at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:296)
	at jenkins.model.Jenkins$5.runTask(Jenkins.java:1083)
	at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:214)
	at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at java.lang.Thread.run(Thread.java:748)

[jetersen]

Fixed in v1.7 should be in the update center shortly @oferziss
Please specify CASC_VAULT_ENGINE_VERSION=1 in your JCasC setup 😅

[oferziss]

works great! thanks 👍

[jetersen]

Your welcome 😊 You should thank @scott-grimes for finding the fix 🙌