unkin/vault-plugin-secrets-rancher
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Return status.bearerToken from minted tokens (fix 401s) #2

Merged
benvin merged 1 commits from benvin/fix-bearer-token into main 2026-07-18 16:31:06 +10:00
Conversation 0 Commits 1 Files Changed 3
+33 -12
unkinben commented 2026-07-18 16:27:16 +10:00
Owner
Copy Link
Copy Source

Why

Live validation against Rancher showed every minted credential (and every rotated root token) fails auth with HTTP 401. Root cause: ext.cattle.io token creation returns two fields — status.value (just the secret fragment) and status.bearerToken (the full usable credential, ext/<name>:<secret>). The plugin returned status.value, which does not authenticate.

Verified directly: bearerToken → HTTP 200; value alone → 401.

Changes

  • client.go: MintToken returns status.bearerToken, falling back to status.value only if a Rancher build omits it. Fixes both dynamic creds and root rotation.
  • Mock Rancher + unit-test fake now return bearerToken; the lifecycle test asserts the minted token is the ext/ bearer form.
## Why Live validation against Rancher showed every minted credential (and every rotated root token) fails auth with **HTTP 401**. Root cause: ext.cattle.io token creation returns two fields — `status.value` (just the secret fragment) and `status.bearerToken` (the full usable credential, `ext/<name>:<secret>`). The plugin returned `status.value`, which does not authenticate. Verified directly: `bearerToken` → HTTP 200; `value` alone → 401. ## Changes - `client.go`: `MintToken` returns `status.bearerToken`, falling back to `status.value` only if a Rancher build omits it. Fixes both dynamic creds and root rotation. - Mock Rancher + unit-test fake now return `bearerToken`; the lifecycle test asserts the minted token is the `ext/` bearer form.
unkinben added 1 commit 2026-07-18 16:27:16 +10:00
Return status.bearerToken, not status.value, from minted tokens
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
22c036d930 
ext.cattle.io token creation returns TWO fields: status.value (just the secret
fragment) and status.bearerToken (the full usable credential, formatted
ext/<name>:<secret>). The plugin was returning status.value, so every minted
credential and every rotated root token was non-functional (401 against
Rancher). Verified: bearerToken authenticates (HTTP 200), value alone does not.

- client.go: MintToken returns status.bearerToken, falling back to status.value
  only if a Rancher build omits it.
- Reflect bearerToken in the mock Rancher and unit-test fake; assert the minted
  token is the ext/ bearer form.
benvin merged commit 97c3d7fdeb into main 2026-07-18 16:31:06 +10:00
benvin deleted branch benvin/fix-bearer-token 2026-07-18 16:31:08 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-rancher#2
Delete Branch "benvin/fix-bearer-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?