face with head bandage Issue Use AWS Secrets Manager secrets

Question

face with head bandage Issue Use AWS Secrets Manager secrets in Flyte core chart face with head bandage Hi our team is trying to use the AWS Secrets and Configuration Provider ASCP for the for our secrets in the `flyte core` chart We have defined our chart values as follow ``` databaseSecret name db pass volume name db pass csi driver secrets store csi k8s io readOnly true volumeAttributes secretProviderClass aws db secrets secretManifest apiVersion secrets store csi x k8s io v1 kind SecretProviderClass metadata name aws db secrets spec provider aws parameters objects | objectName jmesPath path password objectAlias dbpassword``` But the ` helpers tpl` that is not the required for AWS to work How we can avoid that Do we need to change the ` helpers tpl` to add this option Thank you heart hands

Samhita Alla · Answer

I believe so Is it causing any failures in your deployment

Marti Jorda Roca · Answer

yes it does not find my secret ``` Warning FailedMount 26m x371 over 3d kubelet Unable to attach or mount volumes unmounted volumes= db pass unattached volumes= kube api access jgj6s aws iam token db pass config volume timed out waiting for the condition```

Marti Jorda Roca · Answer

the volume pod should be like this to work wiht aws secretes manager ``` volumes name db pass csi driver secrets store csi k8s io readOnly true volumeAttributes secretProviderClass aws db secrets```

Marti Jorda Roca · Answer

but it appears automatically like this for the helpers tpl ``` volumes name db pass secret secretName db pass```

Marti Jorda Roca · Answer

how we can override this default secret configuration

Samhita Alla · Answer

< David Espejo he him > any idea how to fix this

Marti Jorda Roca · Answer

Hi I solved my problem with this configuration ``` databaseSecret name db pass secretManifest apiVersion <http secrets store csi x k8s io v1|secrets store csi x k8s io v1> kind SecretProviderClass metadata name aws db secrets spc spec provider aws parameters objects | objectName Values userSettings db secret objectType secretsmanager jmesPath path password objectAlias dbpassword Create k8s secret It requires volume mount first in the pod and then sync secretObjects secretName db pass type Opaque data objectName dbpassword key dbpassword``` With this the aws csi driver creats a base k8s secret and works i love you hand sign

David Espejo (he/him) · Answer

Thanks for sharing < Marti Jorda Roca> I was just starting to play with this slightly smiling face So the `dbpassword` secret ends up mounted as the `db pass` volume on `flyteadmin` right

Marti Jorda Roca · Answer

yes this is it

Marti Jorda Roca · Answer

sry and also it is required to create another volume <https archive eksworkshop com beginner 194 secrets manager sync native secrets env |more info> ```datacatalog mount another db secret to activate secret store csi to create db pass k8s secret additionalVolumes name aws secret csi driver secrets store csi k8s io readOnly true volumeAttributes secretProviderClass aws db secrets spc additionalVolumeMounts name aws secret mountPath mnt aws secrets readOnly true```

Marti Jorda Roca · Answer

its a little bit hacky

Marti Jorda Roca · Answer

the best would be to allow to override `databaseSecret volume`

David Espejo (he/him) · Answer

< Marti Jorda Roca> agree Would you be up to create an Issue to capture that request

Marti Jorda Roca · Answer

hi yes I have open <https github com flyteorg flyte issues 4336|this issue> If I need to change anything just ask for it it is my first issue sweat smile

David Espejo (he/him) · Answer

Thank you < Marti Jorda Roca> ~What are your thoughts on using this capability ~ ~I know it s not the same but in the meantime is an option to avoid plain text DB password on values~ nvm you re using `flyte core`