azure 秘密存储 csi 驱动程序提供程序抛出错误：秘密 * 未找到

Question

下面是我使用azure csi store provider 的应用程序定义。不幸的是，这个定义抛出了Error: secret 'my-kv-secrets' not found为什么呢？

SecretProvider类

apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: my-app-dev-spc
spec:
  provider: azure
  secretObjects:
  - secretName: my-kv-secrets
    type: Opaque
    data: 
    - objectName: DB-HOST
      key: DB-HOST
  parameters:
    keyvaultName: my-kv-name
    objects: |
      array:
        - |
          objectName: DB-HOST
          objectType: secret
    tenantId: "xxxxx-yyyy-zzzz-rrrr-vvvvvvvv"

荚

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: debug
  name: debug
spec:
  containers:
  - args:
    - sleep
    - 1d
    name: debug
    image: alpine
    env:
    - name: DB_HOST
      valueFrom:
        secretKeyRef:
          name: my-kv-secrets
          key: DB-HOST
  volumes:
  - name: kv-secrets
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: my-app-dev-spc
      nodePublishSecretRef:
        name: my-sp-secrets

Answer 1

事实证明，秘密存储 csi 只能与volumeMounts. 因此，如果您忘记在 yaml 定义中指定它，那么它将无法工作！下面是修复。

荚

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: debug
  name: debug
spec:
  containers:
  - args:
    - sleep
    - 1d
    name: debug
    image: alpine
    env:
    - name: DB_HOST
      valueFrom:
        secretKeyRef:
          name: my-kv-secrets
          key: DB-HOST
    volumeMounts:
    - name: kv-secrets
      mountPath: /mnt/kv_secrets
      readOnly: true
  volumes:
  - name: kv-secrets
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: my-app-dev-spc
      nodePublishSecretRef:
        name: my-sp-secrets