I'm using AKS(v1.20.9). I'm trying to deploy a StatefulSet that uses azure file share as a PV in my cluster.
My pod is stuck at ContainerCreating state and I'm getting the following error :
│ Warning FailedMount 8m57s (x2 over 8m58s) kubelet MountVolume.SetUp failed for volume "buy-vol" : Couldn't get secret ns1/app-buy-secret │
│ Warning FailedMount 6m55s kubelet Unable to attach or mount volumes: unmounted volumes=[buy-vol], unattached volumes=[buy-vol│
My PV and PVC were created successfully :
kubectl get pv/app-buy-azure-file -n ns1
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
app-buy-azure-file 200Mi RWX Retain Bound ns1/app-buy-azure-file 14m
My secrets are created via SecretProviderClass (since the secrets are saved in Azure Key Vault) and are available via kubectl :
kubectl get secret/app-buy-secret -n ns1
NAME TYPE DATA AGE
app-buy-secret Opaque 5 16m
Under the secret I got the keys azurestorageaccountkey and azurestorageaccountname :
kubectl describe secret/app-buy-secret -n ns1
Name: app-buy-secret
Namespace: ns1
Labels: secrets-store.csi.k8s.io/managed=true
Annotations: <none>
Type: Opaque
Data
====
azurestorageaccountname: 23 bytes
app-secret: 36 bytes
tenant-secret: 37 bytes
azurestorageaccountkey: 88 bytes
What might be the issue here ?
The StatefulSet yaml :
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ .Chart.Name }}-statefulset
labels:
{{- include "..labels" . | nindent 4 }}
spec:
serviceName: {{ .Chart.Name }}-service
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
{{- include "..selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "..selectorLabels" . | nindent 8 }}
aadpodidbinding: ״app-buy-binding-selector"
spec:
serviceAccountName: {{ include "..serviceAccountName" . }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
ports:
- name: http
containerPort: 8080
protocol: TCP
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
- mountPath: /mnt/secrets-store
name: secrets-vol
readOnly: true
- mountPath: /app/store/
name: buy-vol
volumes:
- name: secrets-vol
csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: {{ .Chart.Name }}-secret-provider-class
- name: buy-vol
persistentVolumeClaim:
claimName: {{ .Chart.Name }}-azure-file
Role and RoleBinding to ServiceAccount :
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: {{ .Release.Namespace }}
name: {{ .Release.Namespace }}-ns-reader
rules:
- apiGroups: [""]
resources: ["configmaps", "pods", "services", "endpoints", "secrets"]
verbs: ["get", "list", "watch"]
---
{{- if .Values.serviceAccount.create -}}
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "..serviceAccountName" . }}-binding
subjects:
- kind: ServiceAccount
namespace: {{ .Release.Namespace }}
name: {{ include "..serviceAccountName" . }}
apiGroup: ""
roleRef:
kind: Role
name: {{ .Release.Namespace }}-ns-reader
apiGroup: ""
{{- end -}}
If needed, I can add also the yamls of the pv/pvc...