Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mounting from Vault fails with "invalid role name" #217

Open
christian-2 opened this issue Jul 4, 2023 · 2 comments
Open

mounting from Vault fails with "invalid role name" #217

christian-2 opened this issue Jul 4, 2023 · 2 comments

Comments

@christian-2
Copy link

I am trying to get started with Secrets Store CSI Driver, Vault provider, and Vault. In my Vault, I have auth/approle/role/my-role defined; and in my Kubernetes, there is a SecretProviderClass with roleName: my-role.

Yet, the pod that references this SecretProviderClass currently cannot start (status: ContainerCreating); kubectl describe pod indicates the following error:

invalid role name "my-role" Warning FailedMount ... kubelet Unable to attach or mount volumes: 
unmounted volumes=[...], unattached volumes=[], failed to process volumes=[]: timed out waiting for the condition

What could cause the error invalid role name and how can I learn further details? I have found one reference, but it is probably unrelated.

@tomhjp
Copy link
Contributor

tomhjp commented Jul 4, 2023

I'm afraid only Kubernetes and JWT methods are supported at the moment: https://developer.hashicorp.com/vault/docs/platform/k8s/csi#authenticating-with-vault. If you still get the same error with those, please do post your SecretProviderClass config alongside the steps you went through to set up Vault and I can help debug further.

@christian-2
Copy link
Author

I see: so roleName: 'app' apparently led me down the wrong path, namely Vault's approle auth method. But I now see that "The pod's service account must be bound to a Vault role and a policy granting access to the secrets desired" also refers to a Vault role (independently of approle).

I will try again with the kubernetes auth method and will close the issue if/when this succeeds (and if that's okay with you). Thanks for your quick response.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants