You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Start the pod
Observe: The pod fails to find the identity
Expected behavior
The pod starts
Logs
If applicable, add logs to help explain your problem.
"failed to read secret from azure key vault" err="adal: Refresh request failed. Status Code = '400'. Response body: {\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&client_id=bb2edad4-2d5f-4e8a-a11f-b69d277ff284&resource=https%3A%2F%2Fvault.azure.net"
Additional context
This does work with the auth service enabled and AUTH_TYPE "environment-azidentity". I propose the env injecotr pod gets it's own auth type env var (ENV_INJECTOR_AUTH_TYPE) with accepts "environment-azidentity" or "environment" (default)
The text was updated successfully, but these errors were encountered:
Note: Make sure to check out known issues (https://akv2k8s.io/troubleshooting/known-issues/) before submitting
Components and versions
Select which component(s) the bug relates to with [X].
[ ] Controller, version:
1.5.0
(docker image tag)[X] Env-Injector (webhook), version:
1.5.0
(docker image tag)[ ] Other
Describe the bug
When the env injector (not the webhook) starts without the auth service it only supports VM identities and won't use azure workload identity. The issue arises on https://github.com/SparebankenVest/azure-key-vault-to-kubernetes/blob/master/cmd/azure-keyvault-env/authentication.go#L91 where it calls NewFromEnvironment without any way of using NewFromAzidentity
To Reproduce
Steps to reproduce the behavior:
Observe: The pod fails to find the identity
Expected behavior
The pod starts
Logs
If applicable, add logs to help explain your problem.
Additional context
This does work with the auth service enabled and AUTH_TYPE "environment-azidentity". I propose the env injecotr pod gets it's own auth type env var (ENV_INJECTOR_AUTH_TYPE) with accepts "environment-azidentity" or "environment" (default)
The text was updated successfully, but these errors were encountered: