Problem: HashiCorp Vault Storage: syncing on Sync Paths returns '{"errors":[]}'

[ianressa]

Issue

When triggering a sync on a Sync Path in a Vault storage, where the path exists and authentication is working, I get a generic "Cannot list vault secrets" toast. I can replicate the issue with cURL by using the same URI that semaphore is using from the logs.
It seems like the vault client is accessing the path /v1/MOUNT/metadata/PATH/?list=true, and just removing the list argument from the request makes the metadata return fine.

Impact

Other

Installation method

Package

Database

MySQL

Semaphore Version

2.18.20-5d87656-1783280056

Logs & errors

From journalctl -u semaphore:

level=error msg="Cannot list vault secrets" content=vault error="404 Not Found: {\"errors\":[]}\n"

From Vault audit log (with identifying fields removed):

{
  "auth": {
    "policy_results": {
      "allowed": true,
    }
  },
  "request": {
    "headers": {
      "user-agent": [
        "vault-client-go/0.4.3 (Linux x86_64; Go go1.26.4)"
      ]
    },
    "mount_class": "secret",
    "mount_point": "MOUNT/",
    "mount_running_version": "v0.26.2+builtin",
    "mount_type": "kv",
    "operation": "list",
    "path": "MOUNT/metadata/PATH/",
    "remote_address": "SEMAPHORE_ADDRESS",
    "request_uri": "/v1/MOUNT/metadata/PATH/?list=true"
  },
  "response": {
    "mount_class": "secret",
    "mount_point": "MOUNT/",
    "mount_running_plugin_version": "v0.26.2+builtin",
    "mount_type": "kv"
  }
}

Manual installation - system information

RHEL 9.8 5.14.0-611.41.1.el9_7.x86_64

Configuration

In the Sync Path, only the path is set, the separator and prefix are left to the defaults.

[fiftin]

@ianressa PATH/ must be a folder, not a secret. This folder must contain the secrets with format:

{"login": "user1", "password": "239571329"}

[ianressa]

I think I see. So 'Mount' must be the path to a secrets engine? And this only works with KV-type secrets? I think the way I've organized my secrets made this confusing, but I have a successful sync. Thank you!

[ianressa]

A follow up to this, since I don't see documentation for it. When I use a sync path for a variable group I will get an error like this when executing a play with the variable group assigned to the template:

level=error msg="Cannot add task" context=AddTask error="missing key 'string' in the secret <secret/path>"

The play will only execute if I have a key named string in the secret, and the effective value of the synced secret is the value of that key. All the other information in the synced secret is ignored. Is that the intended behavior?

[fiftin]

The secret must have format:

{"string": "secret"}