Cross account secret retrieval about kubernetes-external-secrets HOT 6 CLOSED

@catalinpan I think the arn is wrong in your yaml file - does it work if you specify the key as arn:aws:secretsmanager:eu-west-2:111111111110:secret100?

from kubernetes-external-secrets.

I can take a look at this. On the surface it seems like it should work

from kubernetes-external-secrets.

@jeffpearce thanks for the reply. I've just tested and you are right. The correct key should be
- key: "arn:aws:secretsmanager:eu-west-2:111111111110:secret:secret100".
Just tested and it works as expected. Many thanks!

from kubernetes-external-secrets.

Apologies for reopening this. I am facing a somewhat similar issue (reference: https://github.com/godaddy/kubernetes-external-secrets):

Below is my yaml file:

apiVersion: 'kubernetes-client.io/v1'
kind: ExternalSecret
metadata:
  name: test-secrets
secretDescriptor:
  backendType: secretsManager
  roleArn: arn:aws:iam::1234567890123:role/ExternalSecretRole
  data:
    - key: 'arn:aws:secretsmanager:us-east-1:1234567890123:secret:test-secrets'
      name: test-secrets

aws cli output:

aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:us-east-1:1234567890123:secret:test-secrets-j8Sdcr --region us-east-1
{
    "Name": " test-secrets ",
    "VersionId": "f2d90749-7ded-48e1-bbd9-20b3wrr0rw7b9c8",
    "SecretString": "{\"secretname\":\"secretvalue\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": 1183151199.134,
    "ARN": "arn:aws:secretsmanager:us-east-1:1234567890123:secret:test-secrets-j8Sdcr"
}

When I attempt to check the status of the external secrets, it shows an error:

kubectl -n testing-example get es
NAME               LAST SYNC   STATUS                                                    AGE
test-secrets       0s          ERROR, Secrets Manager can't find the specified secret.   24h

Any ideas on why its showing "ERROR, Secrets Manager can't find the specified secret."?

Thanks

from kubernetes-external-secrets.

@zico-dev Can the node assume the role arn:aws:iam::1234567890123:role/ExternalSecretRole ?

from kubernetes-external-secrets.

Hello @catalinpan ,
Thanks for your quick response. I ensured that the node was able to assume the ExternalSecretRole. I just realized that in the deployment yaml, under the env variable, it was pointing to wrong AWS region (us-west-1). Once I changed that to us-east-1, and reapplied it, it started working!
All is well, thank you very much!!

from kubernetes-external-secrets.