<p>I am facing minor issue with getting secrets from external vaults to aws eks container.</p>
<p>I am using sidecar container for inject secrets in to pods.</p>
<p>I have created secrets at below path ,</p>
<pre><code>vault kv put secrets/mydemo-eks/config username='admin' password='secret'
</code></pre>
<p>my pod yaml is as below,</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: mydemo
  labels:
    app: mydemo
  annotations:
    vault.hashicorp.com/agent-inject: 'true'
    vault.hashicorp.com/agent-inject-status: 'update'
    vault.hashicorp.com/auth-path: 'auth/mydemo-eks'
    vault.hashicorp.com/namespace: 'default'
    vault.hashicorp.com/role: 'mydemo-eks-role'
    vault.hashicorp.com/agent-inject-secret-credentials.txt: 'secrets/data/mydemo-eks/config' 
spec:
  serviceAccountName: mydemo-sa
  containers:
    - name: myapp
      image: nginx:latest
      ports:       
      - containerPort: 80

</code></pre>
<p>when i m checking real time logs,</p>
<p>getting as below,</p>
<p><a href="https://i.stack.imgur.com/Ywi7Z.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Ywi7Z.png" alt="enter image description here" /></a></p>
<p>My Hashicorp Vault policy is as below,</p>
<pre><code>vault policy write mydemo-eks-policy - &lt;&lt;EOF
path &quot;secrets/data/mydemo-eks/config&quot; {
  capabilities = [&quot;read&quot;]
}
EOF
</code></pre>
<p>actually secrets already there on mentioned path,</p>
<p><a href="https://i.stack.imgur.com/yBi94.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yBi94.png" alt="enter image description here" /></a></p>
<p>Any idea....</p>
<p>Is there any wrong i have done.</p>
<p>any one have worked on this scenario?</p>
<p>Thanks</p>

Hardik Patel
<p>I have modified the policy as below,</p>
<pre><code>vault policy write mydemo-eks-policy - &lt;&lt;EOF
path &quot;secrets/mydemo-eks/config&quot; {
  capabilities = [&quot;read&quot;]
}
EOF
</code></pre>
<p>Earlier i used like ,</p>
<pre><code>vault policy write mydemo-eks-policy - &lt;&lt;EOF
path &quot;secrets/data/mydemo-eks/config&quot; {
  capabilities = [&quot;read&quot;]
}
EOF

</code></pre>
