<p>I would like to add a vault to my kubernetes to store JWT, database passwords etc...</p>
<p>I'm using vault from Hashicorp and I followed this documentation: <a href="https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-secret-store-driver" rel="nofollow noreferrer">https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-secret-store-driver</a></p>
<p>My Secret Provider Class and mu ServiceAccount look like :</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ServiceAccount
apiVersion: v1
metadata:
  name: application-sa
  namespace: application-dev
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: application-vault-database
  namespace: application-dev
spec:
  provider: vault
  secretObjects:
    - data:
        - key: password
          objectName: db-password
      secretName: dbpass
      type: Opaque
  parameters:
    vaultAddress: &quot;https://127.0.0.1:8200&quot;
    roleName: &quot;database&quot;
    objects: |
      - objectName: &quot;db-password&quot;
        secretPath: &quot;secret/data/db-pass&quot;
        secretKey: &quot;password&quot;
</code></pre>
<p>and my postgresql database deployment looks like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: application-postgresql-pvc
  namespace: application-dev
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: application-postgresql
  namespace: application-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app: application-postgresql
  template:
    metadata:
      labels:
        app: application-postgresql
    spec:
      serviceAccountName: application-sa
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: application-postgresql-pvc
        - name: secrets-store-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: &quot;application-vault-database&quot;
      containers:
        - name: postgres
          image: postgres:14.5
          env:
            - name: POSTGRES_USER
              value: application
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: dbpass
                  key: password
          ports:
            - containerPort: 5432
          volumeMounts:
            - name: secrets-store-inline
              mountPath: &quot;/mnt/secrets-store&quot;
              readOnly: true
            - name: data
              mountPath: /var/lib/postgresql/data
              subPath: postgres
          resources:
            requests:
              memory: '512Mi'
              cpu: '500m'
            limits:
              memory: '1Gi'
              cpu: '1'
---
apiVersion: v1
kind: Service
metadata:
  name: application-postgresql
  namespace: application-dev
spec:
  selector:
    app: application-postgresql
  ports:
    - port: 5432
</code></pre>
<p>But I'm getting the following error when I start my database pod:</p>
<pre><code>MountVolume.SetUp failed for volume &quot;secrets-store-inline&quot; : rpc error: code = Unknown desc = failed to mount secrets store objects for pod application-dev/application-postgresql-7db74cf6b-8b2q4, err: rpc error: code = Unknown desc = error making mount request: couldn't read secret &quot;db-password&quot;: failed to login: Post &quot;https://127.0.0.1:8200/v1/auth/kubernetes/login&quot;: dial tcp 127.0.0.1:8200: connect: connection refused
</code></pre>
<p>**What I tried: **</p>
<p>regarding my kubernetes config I have :</p>
<p>`kubectl config view``</p>
<pre class="lang-bash prettyprint-override"><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://xxx.api.k8s.fr-par.scw.cloud:6443
  name: k8s-application
contexts:
- context:
    cluster: k8s-application
    user: k8s-application-admin
  name: admin@k8s-application
current-context: admin@k8s-application
kind: Config
preferences: {}
users:
- name: k8s-application-admin
  user:
    token: REDACTED
</code></pre>
<p>the server is: <a href="https://xxx.api.k8s.fr-par.scw.cloud:6443" rel="nofollow noreferrer">https://xxx.api.k8s.fr-par.scw.cloud:6443</a></p>
<p>So I assumed that I had to change my vault kubernetes config to :</p>
<pre class="lang-bash prettyprint-override"><code>vault write auth/kubernetes/config \
&gt;     kubernetes_host=&quot;https://xxx.api.k8s.fr-par.scw.cloud:6443&quot;
</code></pre>
<p>instead of <code>$KUBERNETES_PORT_443_TCP_ADDR</code></p>
<p>For info <code>$KUBERNETES_PORT_443_TCP_ADDR</code> is <code>10.32.0.1</code></p>
<p>I also tried to the <code>vaultAddress</code> in the SPC to &quot;http://vault.default:8200&quot; like in the documentation</p>
<p>Then I got Post &quot;http://vault.default:8200/v1/auth/kubernetes/login&quot;: dial tcp: lookup vault.default on 10.32.0.10:53: no such host</p>
<p>So i guess connection refused of the original conf mean that the host &quot;https://127.0.0.1:8200&quot; is correct but that something is wrong with the kubernetes auth?</p>
<p>What do you think?</p>
<p>Regards</p>

Benjamin Barbé
<p>thanks to @Srishti Khandelwal</p>
<p>I needed to kubectl get service -n namespace</p>
<p>and use the name in my config :</p>
<p><code>http://vault-service-name.namespace:port</code></p>
