unable to store a full secret [ json] with secretObjects: , it stores only for a key

[MaybeOron]

Describe the bug
Hi, for kind: SecretProviderClass ,
seems like it creates k8s secret only if you specify a key with jmesPath.
My aws secrets has structured json which get parsed inside the apps.
I need to store the entire json instead of just a field.
[ did i configured it incorrectly?, I've in tried a few ways ]

• mounting to volume by the secretProviderClass does work, but its critical for me to have it as k8s secret
  so it can be set as an environment variable for a pod

this works:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: secret-provider-class-poc
  namespace: "default"
spec:
  provider: aws
  secretObjects: 
    - secretName: kub-sercret-name
      type: Opaque
      data:
        - key: keyOfAwsSecret
          objectName: "keyOfAwsSecret"

  parameters:
    objects: |
          - objectName: "some-aws-secret"
            objectType: "secretsmanager"
            jmesPath:
                - path: "keyOfAwsSecret"
                  objectAlias: "keyOfAwsSecret"

inside deployment yaml:

        env: 
          - name: "keyOfAwsSecret"
            valueFrom:
              secretKeyRef:
                name: "kub-sercret-name"
                key: "keyOfAwsSecret"

but this won't work:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: secret-provider-class-poc
  namespace: "default"
spec:
  provider: aws
  secretObjects: 
    - secretName: kub-sercret-name
      type: Opaque
      data:
        - key: keyOfSecret ### i tried to remove the key field, didn't work
          objectName: "some-aws-secret"

  parameters:
    objects: |
          - objectName: "some-aws-secret"
            objectType: "secretsmanager"

inside deployment:

        env: 
          - name: "keyOfAwsSecret"
            valueFrom:
              secretKeyRef:
                name: "kub-sercret-name"
                key: "keyOfSecret"

or

         envFrom:                                              
         - secretRef:
             name:  "kub-sercret-name"

To Reproduce

Steps to reproduce the behavior:
try to ceate "secretObjects:" with a full secret object, not a specified key of it.

Expected behavior
Being able to save an entire aws secret json into a k8s secret -> use it as environment variable
Environment:
EKS 1.22

Additional context
If i did it wrong, i will be glad to have an example,
if what i try to do was impossible, can you suggest a solution?
Thanks a lot

[ravinayag]

I'm looking for a similar solution, I want the entire JSON file to be mounted in the pod, instead key values and pairs.

I tried with , but it doesnt work.
spec:
  provider: aws
  type: Kubernetes.io/dockerconfigjson
  parameters:
    objects:  |
        - objectName: MyKeyS
          objectType: secretsmanager

Is there way to mount the entire json file to pod ?

[manozd]

When i try your first woking method it says Error: secret "kub-sercret-name" not found

[davidkuhlke]

@MaybeOron @manozd @ravinayag this is because you need an object alias inside the parameters/objects section for EACH object. e.g. --

parameters:
    objects: |
        - objectName: "aws-test-secret"
          objectAlias: "test_alias"

then when you define your K8s secret use this:

secretObjects:
    - secretName: k8s-test-secret-name
      type: Opaque
      data:
        - objectName: "test_alias"
          key: id

[davidkuhlke]

@MaybeOron, I read through your post again. You do need the key for this to work. The key can be any value you want to use (i.e. "id", "password", "apicreds"). You'll have to reference this key in the deployment when you define your environment variables.