How to get secrets from external vault with aws eks

Question

I am facing minor issue with getting secrets from external vaults to aws eks container.

I am using sidecar container for inject secrets in to pods.

I have created secrets at below path ,

vault kv put secrets/mydemo-eks/config username='admin' password='secret'

my pod yaml is as below,

apiVersion: v1
kind: Pod
metadata:
  name: mydemo
  labels:
    app: mydemo
  annotations:
    vault.hashicorp.com/agent-inject: 'true'
    vault.hashicorp.com/agent-inject-status: 'update'
    vault.hashicorp.com/auth-path: 'auth/mydemo-eks'
    vault.hashicorp.com/namespace: 'default'
    vault.hashicorp.com/role: 'mydemo-eks-role'
    vault.hashicorp.com/agent-inject-secret-credentials.txt: 'secrets/data/mydemo-eks/config' 
spec:
  serviceAccountName: mydemo-sa
  containers:
    - name: myapp
      image: nginx:latest
      ports:       
      - containerPort: 80

when i m checking real time logs,

getting as below,

My Hashicorp Vault policy is as below,

vault policy write mydemo-eks-policy - <<EOF
path "secrets/data/mydemo-eks/config" {
  capabilities = ["read"]
}
EOF

actually secrets already there on mentioned path,

Any idea....

Is there any wrong i have done.

any one have worked on this scenario?

Thanks

Answer 1

I have modified the policy as below,

vault policy write mydemo-eks-policy - <<EOF
path "secrets/mydemo-eks/config" {
  capabilities = ["read"]
}
EOF

Earlier i used like ,

vault policy write mydemo-eks-policy - <<EOF
path "secrets/data/mydemo-eks/config" {
  capabilities = ["read"]
}
EOF