Secrets not created in chart v0.0.20

[ahmedig]

What steps did you take and what happened:
I have been using this driver provider with absolute no issues. I use it to mount the secrets from my keyvault as a volume, and also expose them as kubernetes secrets.
I authenticate using SPN and not Pod identity.

Until chart version 0.0.19 it was working all fine, when I upgraded to 0.0.20, my deployments are failing. I found out that the kubernetes secrets were not created at all, might be because of the volume not being mounted. Couldnt "ls" the driver in the pod because it was crashing.

Reverted back to 0.0.19, everything worked fine again.

What did you expect to happen:
The volume to be mounted, and kubernetes secrets to be created

Anything else you would like to add:
I ran kubectl logs -n operations akv2aks-csi-secrets-store-provider-azure-bgstx
it looked pretty normal, compared the outputs in 0.0.20 and 0.0.19 and they were similar
"successfully wrote file" file="AWS--ECS--ApiKey" pod="myapp/service-abc-55c59b9857-hspdb"

Which access mode did you use to access the Azure Key Vault instance:
Service Principal

Environment:

• Secrets Store CSI Driver version: (use the image tag): 0.0.20
• Azure Key Vault provider version: (use the image tag): 0.0.16
• Kubernetes version: (use kubectl version and kubectl get nodes -o wide): 1.19.9
• Cluster type: (e.g. AKS, aks-engine, etc): AKS

[aramase]

Ahmed Elsayed (@ahmedig) Thank you for reporting the issue.

The logs from secrets-store container in the driver pod should have more information on why the sync secret failed. Here is our troubleshooting guide: https://azure.github.io/secrets-store-csi-driver-provider-azure/troubleshooting/

Did you set secrets-store-csi-driver.syncSecret.enabled=true as part of helm install while setting up the driver and provider? In the latest release the RBAC roles and rolebindings required for sync secret are not installed by default. They need to be explicitly set as part of helm install command. This is called out in the release notes: https://github.com/Azure/secrets-store-csi-driver-provider-azure/releases/tag/0.0.16

Here is a list of helm configurable values: https://github.com/Azure/secrets-store-csi-driver-provider-azure/tree/master/charts/csi-secrets-store-provider-azure#configuration
Upgrade instructions: https://azure.github.io/secrets-store-csi-driver-provider-azure/upgrading/#upgrading-to-helm-chart-version-0020
Install instructions: https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/sync-with-k8s-secrets/

[ahmedig]

Thank you for the very quick response!
Yes I can confirm that setting the flag syncSecret.enabled=true has fixed the problem. We didnt have to set the flag in the older versions, but starting version 0.0.20, this is necessary to be explicitly set.

Thanks for your help again!