<p>Unable to read the secrets stored in Vault at path /secrets/apims/ABC_CONFIG using below setup</p>
<p>Policy created in Vault:</p>
<pre><code>  vault policy write policy_name - &lt;&lt;EOF
    path &quot;secret/apims/*&quot; {
      capabilities = [&quot;read&quot;]
    }
</code></pre>
<p>Role created in Vault</p>
<pre><code>vault write auth/kubernetes/role/role_name\
    bound_service_account_names=service_account_name \
    bound_service_account_namespaces=default \
    policies=policy_name \
    ttl=24h
</code></pre>
<p>Using Kubernetes vault sidecar injector over the external vault. The deployment on Kubernetes looks like</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: &quot;apps/v1&quot;
kind: &quot;Deployment&quot;
metadata:
  name: &quot;nginx-5&quot;
  namespace: &quot;default&quot;
  labels:
    app: &quot;nginx-5&quot;
spec:
  replicas: 1
  selector:
    matchLabels:
      app: &quot;nginx-5&quot;
  template:
    metadata:
      annotations: 
        vault.hashicorp.com/agent-inject: &quot;true&quot;
        vault.hashicorp.com/agent-inject-secret-credentials.conf: secret/ABC_CONFIG
        vault.hashicorp.com/role: role_name
      labels:
        app: &quot;nginx-5&quot;
    spec:
      containers:
      - name: &quot;nginx-5&quot;
        image: &quot;nginx:latest&quot;
      serviceAccountName: service_account_name
</code></pre>
<p>Though Kubernetes is successfully authorized with Vault, reading specific keys fails with 403.</p>
<p><a href="https://i.stack.imgur.com/B6tNN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/B6tNN.png" alt="image1" /></a></p>
<p><a href="https://i.stack.imgur.com/nuBdS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/nuBdS.png" alt="image2" /></a></p>
<p>Thanks for your help.</p>

<p>Looks like neither the service account nor the role name defined in the Vault role matches the ones in the deployment.</p>
<ul>
<li>Service Account = service_account_name</li>
<li>Role = role_name</li>
</ul>
<pre><code>vault write auth/kubernetes/role/role_name\
    bound_service_account_names=service_account_name \
    bound_service_account_namespaces=default \
    policies=policy_name \
    ttl=24h
</code></pre>
<ul>
<li>Service Account = sa-vault-auth</li>
<li>Role = apims</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>spec:
  replicas: 1
  selector:
    matchLabels:
      app: &quot;nginx-5&quot;
  template:
    metadata:
      annotations: 
        vault.hashicorp.com/agent-inject: &quot;true&quot;
        vault.hashicorp.com/agent-inject-secret-credentials.conf: secret/ABC_CONFIG
        vault.hashicorp.com/role: apims 👈
      labels:
        app: &quot;nginx-5&quot;
    spec:
      containers:
      - name: &quot;nginx-5&quot;
        image: &quot;nginx:latest&quot;
      serviceAccountName: sa-vault-auth 👈
...
</code></pre>
<p>This is also assuming that <code>policies=policy_name</code> is the name of the policy that you created in Vault initially.</p>
