☰

Azure 密钥保管库卷无法访问，如何解决？

tag-icon • tag-icon azure kubernetes aks vault
Azure 密钥保管库卷无法访问，如何解决？

我已按照本文提供的指南进行操作关联

在步骤 6 中，我尝试创建一个与 keyvault 关联的卷的 pod。

但它无法访问该卷。

kubectl get pods
NAME                                         READY   STATUS              RESTARTS   AGE
busybox-secrets-store-inline                 0/1     ContainerCreating   0          27s
csi-csi-secrets-store-provider-azure-2fwqd   1/1     Running             0          45m
csi-secrets-store-csi-driver-d6zjv           3/3     Running             0          45m


 kubectl describe pod busybox-secrets-store-inline
Name:         busybox-secrets-store-inline
Namespace:    default
Priority:     0
Node:         aks-agentpool-22716505-vmss000001/10.240.0.5
Start Time:   Mon, 26 Jul 2021 21:45:02 +0530
Labels:       <none>
Annotations:  <none>
Status:       Pending
IP:
IPs:          <none>
Containers:
  busybox:
    Container ID:
    Image:         k8s.gcr.io/e2e-test-images/busybox:1.29
    Image ID:
    Port:          <none>
    Host Port:     <none>
    Command:
      /bin/sleep
      10000
    State:          Waiting
      Reason:       ContainerCreating
    Ready:          False
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /mnt/secrets-store from secrets-store-inline (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-g7shm (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  secrets-store-inline:
    Type:              CSI (a Container Storage Interface (CSI) volume source)
    Driver:            secrets-store.csi.k8s.io
    FSType:
    ReadOnly:          true
    VolumeAttributes:      secretProviderClass=azure-kvname
  default-token-g7shm:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-g7shm
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason       Age    From               Message
  ----     ------       ----   ----               -------
  Normal   Scheduled    3m50s  default-scheduler  Successfully assigned default/busybox-secrets-store-inline to aks-agentpool-22716505-vmss000001
  Warning  FailedMount  110s   kubelet            MountVolume.SetUp failed for volume "secrets-store-inline" : rpc error: code = DeadlineExceeded desc = context deadline exceeded
  Warning  FailedMount  107s   kubelet            Unable to attach or mount volumes: unmounted volumes=[secrets-store-inline], unattached volumes=[secrets-store-inline default-token-g7shm]: timed out waiting for the condition

如何解决这个问题？

答案1

这通常是权限问题。请确保您已正确指定服务主体 ID 和密码，并确保已使用访问策略授予其对密钥保管库的访问权限，这与 Azure RBAC 权限无关。

相关内容