When I attache secrets in deployment it doesn't create `secretObjects` for pods to get parameter

966 Views Asked by At

I am trying to create pods and attached ssmparamaters to these pods. And I create secret.yaml file for creating SecretProviderClass and secretObjects to attache pods these secret provider class and secret objects. Here is the file:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: aws-secrets
  namespace: default
spec:
  provider: aws
  secretObjects:
    - secretName: dbsecret
      type: Opaque
      data:
        - objectName: dbusername
          key: username
        - objectName: dbpassword
          key: password
  parameters:
      objects: |
        - objectName: "secure-store"
          objectType: "ssmparameter"
          jmesPath:
            - path: username
              objectAlias: dbusername
            - path: password
              objectAlias: dbpassword

Also, I created a service account to attach deployment. Here is the file

apiVersion: v1
kind: ServiceAccount
metadata:
  name: csi-provider-user
  namespace: default 
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789078:role/test-oidc

Here is the deployment file where I tried to create env variables in order to get parameters from parameter store from secrets and attache pods.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: new-app
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: new-app
  template:
    metadata:
      labels:
        app: new-app
    spec:
      containers:
      - name: new-app
        image: nginx:1.14.2
        resources:
          requests:
            memory: "300Mi"
            cpu: "500m"
          limits:
            memory: "500Mi"
            cpu: "1000m"
        ports:
        - containerPort: 80
        volumeMounts:
          - name: secrets-store-inline
            mountPath: "/mnt/secrets-store"
            readOnly: true
        env:
          - name: DB_USERNAME_01
            valueFrom:
              secretKeyRef:
                name: dbsecret
                key: username
          - name: DB_PASSWORD_01
            valueFrom:
              secretKeyRef:
                name: dbsecret
                key: password
      serviceAccountName: csi-provider-user
      volumes:
        - name: secrets-store-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "aws-secrets"

But when I apply these files and create deployment I get this error:

Error: secret "dbsecret" not found

It doesn't create secret objects for some reason:

  secretObjects:
    - secretName: dbsecret

I might miss some configurations. Thanks for your help!

0

There are 0 best solutions below