<p>I have a local Kubernetes cluster running on my mac using minikube.
I want to mount secrets stored on AWS Secret Manager into my pod.</p>
<p>Basically I'm trying to achieve what's described in <a href="https://aws.amazon.com/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/" rel="nofollow noreferrer">this</a> tutorial, but for a cluster running locally, and not on EKS.</p>
<p>I've installed the CSI driver by running</p>
<pre><code>helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
</code></pre>
<p>and</p>
<pre><code>helm install -n kube-system csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver
</code></pre>
<p>and also installed the aws provider service account by applying:</p>
<pre><code>kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/deployment/aws-provider-installer.yaml
</code></pre>
<p>In addition I've applied my 'secretProviderClass' yml to my minikube cluster:</p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: mypod-aws-secrets
  namespace: default
spec:
  provider: aws
  parameters:
    objects: |
        - objectName: &quot;testSecret&quot;
          objectType: &quot;secretsmanager&quot;
          jmesPath:
            - path: testSecretKey
              objectAlias: testSecretKey
</code></pre>
<p>and lastly in my pod's deployment.yml I tried to mount using this <code>mypod-aws-secrets</code> (just the relevant part):</p>
<pre><code>spec:
    replicas: 1
    selector:
        matchLabels:
            component: myPod
    template:
        metadata:
            labels:
                component: myPod
        spec:
            serviceAccountName: application-pod-sa
            volumes:
            - name: secrets-store-inline
              csi:
                driver: secrets-store.csi.k8s.io
                readOnly: true
                volumeAttributes:
                    secretProviderClass: mypod-aws-secrets
</code></pre>
<p>However, the pod failed to start and I get the following error:</p>
<pre><code>MountVolume.SetUp failed for volume &quot;secrets-store-inline&quot; : rpc error: code = Unknown desc = failed to mount secrets store objects for pod default/myPod-579bdf9b57-dd9tq, err: rpc error: code = Unknown desc = failed to retrieve region from node. error Region not found
</code></pre>
<p>Which make sense to me because so far, I didn't let my minikube cluster know any info about the concrete AWS Secret Manager, nor did I gave my minikube cluster any permission to access this AWS Secret Manager on my AWS account.
My questions are:</p>
<ol>
<li>Where/how should I add this information?</li>
<li>What's missing in order to get it to work?</li>
</ol>
<p>Thanks</p>

Noam
<p>The CSI driver for AWS Secrets and Configuration Manager <a href="https://github.com/aws/secrets-store-csi-driver-provider-aws/tree/main#requirements" rel="nofollow noreferrer">documentation</a> says this is only for AWS EKS clusters.</p>
<p>So there are a few things that are missing in <code>minikube</code> (and any other k8s distribution):</p>
<ul>
<li>The region, i.e the error you're facing. This is actually taken from the k8s node label <code>topology.kubernetes.io/region</code> that is added by most cloud k8s providers. You can add it on your <code>minikube</code> node but it won't get you much further... see below</li>
<li>Credentials for <code>secrets-store-csi-driver-provider-aws</code> to open a session with AWS and provide access respecting the IAM role annotated on the serviceAccount.</li>
</ul>
<p>For this later point, I haven't researched further but I suspect that this is thanks to EKS providing IRSA (IAM Roles for ServiceAccounts) abilities by default. I don't know if it's possible to get the same functionality outside of AWS or even EKS.</p>
<p>Maybe digging into &quot;IAM Anywhere&quot; could provide a solution, but at a quick glance it seems like a lot of setup and that doesn't match the typical &quot;temporary local k8s&quot; usage of <code>minikube</code>.</p>
<p>Another thing to progress might be to dig into <code>secrets-store-csi-driver-provider-aws</code> code and see if it's possible to provide it with AWS credentials (an access key / token?) so it's able to open that session.</p>
