<p>I'm following <a href="https://aws.amazon.com/it/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/" rel="nofollow noreferrer">this AWS documentation</a> which explains how to properly configure AWS Secrets Manager to let it works with EKS through Kubernetes Secrets.</p>
<p>I successfully followed step by step all the different commands as explained in the documentation.</p>
<p>The only difference I get is related to <a href="https://aws.amazon.com/it/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/#:%7E:text=kubectl%20get%20po%20%2D%2Dnamespace%3Dkube%2Dsystem" rel="nofollow noreferrer">this step</a> where I have to run:</p>
<pre><code>kubectl get po --namespace=kube-system 
</code></pre>
<p>The expected output should be:</p>
<pre><code>csi-secrets-store-qp9r8         3/3     Running   0          4m
csi-secrets-store-zrjt2         3/3     Running   0          4m
</code></pre>
<p>but instead I get:</p>
<pre><code>csi-secrets-store-provider-aws-lxxcz               1/1     Running   0          5d17h
csi-secrets-store-provider-aws-rhnc6               1/1     Running   0          5d17h
csi-secrets-store-secrets-store-csi-driver-ml6jf   3/3     Running   0          5d18h
csi-secrets-store-secrets-store-csi-driver-r5cbk   3/3     Running   0          5d18h
</code></pre>
<p>As you can see the names are different, but I'm quite sure it's ok :-)</p>
<p>The real problem starts <a href="https://aws.amazon.com/it/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/#:%7E:text=kubectl%20apply%20%2Df%20%2D-,Step%204,-%3A%20Create%20and%20deploy" rel="nofollow noreferrer">here in step 4</a>: I created the following YAML file (as you ca see I added some parameters):</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
 name: aws-secrets
spec:
 provider: aws
 parameters:
   objects:  |
     - objectName: &quot;mysecret&quot;
       objectType: &quot;secretsmanager&quot;

</code></pre>
<p>And finally I created a deploy (as explain <a href="https://aws.amazon.com/it/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/#:%7E:text=MySecret2%22%0A%20%20%20%20%20%20%20%20objectType%3A%20%22secretsmanager%22-,Step%205,-%3A%20Configure%20and%20deploy" rel="nofollow noreferrer">here in step 5</a>) using the following yaml file:</p>
<pre class="lang-yaml prettyprint-override"><code># test-deployment.yaml
kind: Pod
apiVersion: v1
metadata:
  name: nginx-secrets-store-inline
spec:
  serviceAccountName: iamserviceaccountforkeyvaultsecretmanagerresearch
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - name: mysecret-volume
      mountPath: &quot;/mnt/secrets-store&quot;
      readOnly: true
  volumes:
    - name: mysecret-volume
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: &quot;aws-secrets&quot;

</code></pre>
<p>After the deployment through the command:</p>
<pre><code>kubectl apply -f test-deployment.yaml -n mynamespace
</code></pre>
<p>The pod is not able to start properly because the following error is generated:</p>
<pre><code>Error from server (BadRequest): container &quot;nginx&quot; in pod &quot;nginx-secrets-store-inline&quot; is waiting to start: ContainerCreating
</code></pre>
<p>But, for example, if I run the deployment with the following yaml <strong>the POD will be successfully created</strong></p>
<pre class="lang-yaml prettyprint-override"><code># test-deployment.yaml

kind: Pod
apiVersion: v1
metadata:
  name: nginx-secrets-store-inline
spec:
  serviceAccountName: iamserviceaccountforkeyvaultsecretmanagerresearch
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - name: keyvault-credential-volume
      mountPath: &quot;/mnt/secrets-store&quot;
      readOnly: true
  volumes:
    - name: keyvault-credential-volume
      emptyDir: {} # &lt;&lt;== !! LOOK HERE !!
</code></pre>
<p>as you can see I used</p>
<pre><code>emptyDir: {}
</code></pre>
<p>So as far I can see the <strong>problem</strong> here is related to the following YAML lines:</p>
<pre class="lang-yaml prettyprint-override"><code>      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: &quot;aws-secrets&quot;
</code></pre>
<p>To be honest it's even not clear in my mind what's happing here.
Probably I didn't properly enabled the volume permission in EKS?</p>
<p>Sorry but I'm a newbie in both AWS and Kubernetes configurations.
Thanks for you time</p>
<p>--- NEW INFO ---</p>
<p>If I run</p>
<pre><code>kubectl describe pod nginx-secrets-store-inline -n mynamespace
</code></pre>
<p>where <em>nginx-secrets-store-inline</em> is the name of the pod, I get the following output:</p>
<pre><code>Events:
  Type     Reason       Age                From               Message
  ----     ------       ----               ----               -------
  Normal   Scheduled    30s                default-scheduler  Successfully assigned mynamespace/nginx-secrets-store-inline to ip-10-0-24-252.eu-central-1.compute.internal
  Warning  FailedMount  14s (x6 over 29s)  kubelet            MountVolume.SetUp failed for volume &quot;keyvault-credential-volume&quot; : rpc error: code = Unknown desc = failed to get secretproviderclass mynamespace/aws-secrets, error: SecretProviderClass.secrets-store.csi.x-k8s.io &quot;aws-secrets&quot; not found
</code></pre>
<p>Any hints?</p>

<p>Finally I realized why it wasn't working. As explained <a href="https://secrets-store-csi-driver.sigs.k8s.io/troubleshooting.html#common-errors" rel="nofollow noreferrer">here</a>, the error:</p>
<pre><code>  Warning  FailedMount  3s (x4 over 6s)  kubelet, kind-control-plane  MountVolume.SetUp failed for volume &quot;secrets-store-inline&quot; : rpc error: code = Unknown desc = failed to get secretproviderclass default/azure, error: secretproviderclasses.secrets-store.csi.x-k8s.io &quot;azure&quot; not found
</code></pre>
<p>is related to namespace:</p>
<blockquote>
<p>The SecretProviderClass being referenced in the volumeMount needs to exist in the same namespace as the application pod.</p>
</blockquote>
<p>So both the yaml file should be deployed in the same namespace (adding, for example, the <em>-n mynamespace</em> argument).
Finally I got it working!</p>
