<p>I have created an apps cluster deployment on AWS EKS that is deployed using Helm. For proper operation of my app, I need to set env variables, which are secrets stored in AWS Secrets manager. Referencing a <a href="https://www.eksworkshop.com/beginner/194_secrets_manager/sync_native_secrets_env/" rel="nofollow noreferrer">tutorial</a>, I set up my values in <code>values.yaml</code> file someway like this</p>
<pre><code>secretsData:
  secretName: aws-secrets
  providerName: aws
  objectName: CodeBuild
</code></pre>
<p>Now I have created a secrets provider class as AWS recommends: <code>secret-provider.yaml</code></p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: aws-secret-provider-class

spec:
  provider: {{ .Values.secretsData.providerName }}
  parameters:
    objects: |
      - objectName: &quot;{{ .Values.secretsData.objectName }}&quot;
        objectType: &quot;secretsmanager&quot;
        jmesPath: 
            - path: SP1_DB_HOST
              objectAlias: SP1_DB_HOST
            - path: SP1_DB_USER
              objectAlias: SP1_DB_USER
            - path: SP1_DB_PASSWORD
              objectAlias: SP1_DB_PASSWORD
            - path: SP1_DB_PATH
              objectAlias: SP1_DB_PATH
  secretObjects:
    - secretName: {{ .Values.secretsData.secretName }} 
      type: Opaque
      data:
        - objectName: SP1_DB_HOST
          key: SP1_DB_HOST
        - objectName: SP1_DB_USER
          key: SP1_DB_USER
        - objectName: SP1_DB_PASSWORD
          key: SP1_DB_PASSWORD
        - objectName: SP1_DB_PATH
          key: SP1_DB_PATH

</code></pre>
<p>I mount this secret object in my <code>deployment.yaml</code>, the relevant section of the file looks like this:</p>
<pre><code>volumeMounts:
            - name: secrets-store-volume
              mountPath: &quot;/mnt/secrets&quot;
              readOnly: true
          env:
            - name: SP1_DB_HOST
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.secretsData.secretName }}
                  key: SP1_DB_HOST
            - name: SP1_DB_PORT
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.secretsData.secretName }}
                  key: SP1_DB_PORT

</code></pre>
<p>further down in same deployment file, I define <code>secrets-store-volume</code> as :</p>
<pre><code>      volumes:
        - name: secrets-store-volume
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: aws-secret-provider-class
</code></pre>
<p><em>All drivers are installed into cluster and permissions are set accordingly</em></p>
<p>with <code>helm install mydeployment helm-folder/ --dry-run</code> I can see all the files and values are populated as expected. Then with <code>helm install mydeployment helm-folder/</code> I install the deployment into my cluster but with <code>kubectl get all</code> I can see the pod is stuck at <code>Pending</code> with warning <code>Error: 'aws-secrets' not found</code> and eventually gets timeout. In AWS CloudTrail log, I can see that the cluster made request to access the secret and there was no error fetching it. How can I solve this or maybe further debug it? Thank you for your time and efforts.</p>

Bijay Regmi
<p><code>Error: 'aws-secrets' not found</code> - looks like CSI Driver isn't creating kubernetes secret that you're using to reference values</p>
<p>Since yaml files looks correctly, I would say it's probably CSI Driver configuration <a href="https://secrets-store-csi-driver.sigs.k8s.io/topics/sync-as-kubernetes-secret.html" rel="nofollow noreferrer">Sync as Kubernetes secret</a> - <code>syncSecret.enabled</code> (which is false by default)</p>
<p>So make sure that secrets-store-csi-driver runs with this flag set to true, for example:</p>
<pre><code>helm upgrade --install csi-secrets-store \
--namespace kube-system secrets-store-csi-driver/secrets-store-csi-driver \
--set grpcSupportedProviders=&quot;aws&quot; --set syncSecret.enabled=&quot;true&quot;
</code></pre>
