Kubernetes Secret is not being generate

[gowthambalram]

Hi,

We have installed the CSI driver and followed the steps to create the SecretProviderClass with secretObjects to create the kubernetes secret for the certificate, however, the kubernetes secret is not getting generated even after deploying the pod. The mounted path has the certificate as expected though.

Attaching the various files below used in the deployment, can you please help us where we are going wrong:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
name: aks-ingress-tls-demo
spec:
provider: azure
secretObjects:

secretName: aks-ingress-tl
type: kubernetes.io/tls
data:
objectName: sample-app-com
key: tls.key
objectName: sample-app-com
key: tls.crt
parameters:
usePodIdentity: "false"
keyvaultName: "vault-name"
objects: |
array:
|
objectName: sample-app-com
objectType: secret
tenantId: "Tenant ID Here"
apiVersion : apps/v1
kind: Deployment
metadata:
name: sample-app
spec:
replicas: 1
selector:
matchLabels:
app: sample-app
template:
metadata:
labels:
app: sample-app
spec:
containers:

• name: sample-app
  image: acr.azurecr.io/dev:v1
  ports:
• containerPort: 80
  resources:
  limits:
  cpu: 200m
  memory: 256Mi
  requests:
  cpu: 100m
  memory: 128Mi
  volumeMounts:
• name: aks-ingress-tls-demo
  mountPath: "/mnt/secrets-store"
  readOnly: true
  volumes:
• name: aks-ingress-tls-demo
  csi:
  driver: secrets-store.csi.k8s.io
  readOnly: true
  volumeAttributes:
  secretProviderClass: aks-ingress-tls-demo
  nodePublishSecretRef:
  name: secrets-store-creds

[aramase]

Hello 👋🏻

• While installing the driver with helm charts, did you set secrets-store-csi-driver.syncSecret.enabled=true?

To check the driver and provider logs, refer to our troubleshooting guide. If the error in driver is similar to this, then you need to enable the sync secret feature as part of the helm installation. Here is more info on the helm value required for sync secret to work: https://azure.github.io/secrets-store-csi-driver-provider-azure/docs/configurations/sync-with-k8s-secrets/#how-to-sync-mounted-content-with-kubernetes-secret

[gowthambalram]

thanks a lot, @aramase. It worked!