Not able to have secrets on /tmp/secret about aws-secret-sidecar-injector HOT 4 CLOSED

You need to use the thumbprint of the OIDC provider, see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html

Try re-creating the OIDC provider and test the solution.

from aws-secret-sidecar-injector.

@Painyjames Thanks for testing the solution out.

Could you please share the output of below command to verify if the init container ran fine.
kubectl describe pod webserver-5899d5548-md8zm | grep "Init Containers" -A 10

Note - Replace the webserver pod name with the correct one

The status should show something like

  secrets-init-container:
    Container ID:   docker://xxxxxyyyyzzzz
    Image:          docker.io/amazon/aws-secrets-manager-secret-sidecar:v0.1.1
    Image ID:       docker-pullable://amazon/aws-secrets-manager-secret-sidecar@sha256:xxxxyyyyzzzz
    Port:           <none>
    Host Port:      <none>
    State:          Terminated
      Reason:       Completed
      Exit Code:    0
      Started:      Fri, 17 Jul 2020 08:21:57 -0500

Now check the logs of the init container and the webserver pod with the below commands -

kubectl logs webserver-5899d5548-md8zm -c secrets-init-container
kubectl logs webserver-5899d5548-md8zm

The output should be empty for the init container and display the secret value for the webserver pod.

Other steps to check -

• Verify if the OIDC provider exists in the IAM console under Identity providers section
• Verify if the IAM role webserver-secrets-role has the policy webserver-secrets-policy attached with the correct OIDC trust relationship

Please post your response here.

from aws-secret-sidecar-injector.

Apparently the pod is ok.

  secrets-init-container:
    Container ID:   docker://7b184e816e0d4f3270ba8c973b1f78fd508ac2f9e684922a5049f7c202b408ab
    Image:          docker.io/amazon/aws-secrets-manager-secret-sidecar:v0.1.1
    Image ID:       docker-pullable://amazon/aws-secrets-manager-secret-sidecar@sha256:079028dde7738a622ecbf35ee6b345bba7a0a5f40584c4e97e21535ced0cc421
    Port:           <none>
    Host Port:      <none>
    State:          Terminated
      Reason:       Completed
      Exit Code:    0
      Started:      Fri, 17 Jul 2020 10:53:48 +0100

but if we get the logs for the init container we receive the following:

kubectl logs webserver-7b56c5866-9sr5l  -c secrets-init-container
WebIdentityErr: failed to retrieve credentials
caused by: InvalidIdentityToken: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint
	status code: 400, request id: 7a767a2d-1a17-46a5-89d0-7ed93fb3120b

Might be this related to the certificates generated by the helm chart?

from aws-secret-sidecar-injector.

@sai1621 you were right, the OIDC thumbprint changed since the last time and we needed to recreate it.
We are getting the secrets successfully now.

from aws-secret-sidecar-injector.