<p>Per the title, I have the integration working following <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes" rel="nofollow noreferrer">the documentation</a>.</p>
<p>I can deploy the <code>nginx.yaml</code> and after about 70 seconds I can print out secrets with:</p>
<pre><code>kubectl exec -it nginx -- cat /mnt/secrets-store/secret1
</code></pre>
<p>Now I'm trying to apply it to a PostgreSQL deployment for testing and I get the following from the Pod <code>description</code>:</p>
<pre><code>  Warning  FailedMount             3s    kubelet                  MountVolume.SetUp failed for volume &quot;secrets-store01-inline&quot; : rpc error: code = Unknown desc = failed to mount secrets store objects for pod staging/postgres-deployment-staging-69965ff767-8hmww, err: rpc error: code = Unknown desc = failed to mount objects, error: failed to get keyvault client: failed to get key vault token: nmi response failed with status code: 404, err: &lt;nil&gt;
</code></pre>
<p>And from the <code>nmi logs</code>:</p>
<pre><code>E0221 22:54:32.037357       1 server.go:234] failed to get identities, error: getting assigned identities for pod staging/postgres-deployment-staging-69965ff767-8hmww in CREATED state failed after 16 attempts, retry duration [5]s, error: &lt;nil&gt;. Check MIC pod logs for identity assignment errors
I0221 22:54:32.037409       1 server.go:192] status (404) took 80003389208 ns for req.method=GET reg.path=/host/token/ req.remote=127.0.0.1
</code></pre>
<p>Not sure why since I basically copied the settings from the <code>nignx.yaml</code> into the <code>postgres.yaml</code>. Here they are:</p>
<pre><code># nginx.yaml
kind: Pod
apiVersion: v1
metadata:
  name: nginx
  namespace: staging
  labels:
    aadpodidbinding: aks-akv-identity-binding-selector
spec:
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
      - name: secrets-store01-inline
        mountPath: /mnt/secrets-store
        readOnly: true
  volumes:
    - name: secrets-store01-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: aks-akv-secret-provider
</code></pre>
<pre><code># postgres.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment-staging
  namespace: staging
  labels:
    aadpodidbinding: aks-akv-identity-binding-selector
spec:
  replicas: 1
  selector:
    matchLabels:
      component: postgres
  template:
    metadata:
      labels:
        component: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:13-alpine
          ports:
            - containerPort: 5432
          volumeMounts:
          - name: secrets-store01-inline
            mountPath: /mnt/secrets-store
            readOnly: true
          - name: postgres-storage-staging
            mountPath: /var/postgresql
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: aks-akv-secret-provider
        - name: postgres-storage-staging
          persistentVolumeClaim:
            claimName: postgres-storage-staging

---
apiVersion: v1
kind: Service
metadata:
  name: postgres-cluster-ip-service-staging
  namespace: staging
spec:
  type: ClusterIP
  selector:
    component: postgres
  ports:
    - port: 5432
      targetPort: 5432
</code></pre>
<p>Suggestions for what the issue is here?</p>

cjones
<p>Oversight on my part... the <code>aadpodidbinding</code> should be in the <code>template:</code> per:</p>
<p><a href="https://azure.github.io/aad-pod-identity/docs/best-practices/#deploymenthttpskubernetesiodocsconceptsworkloadscontrollersdeployment" rel="nofollow noreferrer">https://azure.github.io/aad-pod-identity/docs/best-practices/#deploymenthttpskubernetesiodocsconceptsworkloadscontrollersdeployment</a></p>
<p>The resulting YAML should be:</p>
<pre><code># postgres.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment-production
  namespace: production
spec:
  replicas: 1
  selector:
    matchLabels:
      component: postgres
  template:
    metadata:
      labels:
        component: postgres
        aadpodidbinding: aks-akv-identity-binding-selector
    spec:
      containers:
        - name: postgres
          image: postgres:13-alpine
          ports:
            - containerPort: 5432
          env: 
            - name: POSTGRES_DB_FILE
              value: /mnt/secrets-store/DEV-PGDATABASE
            - name: POSTGRES_USER_FILE
              value: /mnt/secrets-store/DEV-PGUSER
            - name: POSTGRES_PASSWORD_FILE
              value: /mnt/secrets-store/DEV-PGPASSWORD
            - name: POSTGRES_INITDB_ARGS
              value: &quot;-A md5&quot;
            - name: PGDATA
              value: /var/postgresql/data
          volumeMounts:
          - name: secrets-store01-inline
            mountPath: /mnt/secrets-store
            readOnly: true
          - name: postgres-storage-production
            mountPath: /var/postgresql
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: aks-akv-secret-provider
        - name: postgres-storage-production
          persistentVolumeClaim:
            claimName: postgres-storage-production
---
apiVersion: v1
kind: Service
metadata:
  name: postgres-cluster-ip-service-production
  namespace: production
spec:
  type: ClusterIP
  selector:
    component: postgres
  ports:
    - port: 5432
      targetPort: 5432
</code></pre>
