Some CSI drivers write to /etc/kubernetes/secrets-store-csi-providers

[joebaro]

Image I'm using:
EKS 1.17 with Bottlerocket OS 1.0.8 (ami-04f83bfb1bb568e28)

What I expected to happen:
Install and run the Secret Store CSI driver and the AWS provider plugin by following the setup instructions in the secrets-store-csi-driver-provider-aws README.

What actually happened:
The driver plugin fails with "permission denied" when binding to a unix domain socket in /etc/kubernetes/secrets-store-csi-providers/aws.sock (see also secrets-store-csi-driver-provider-aws issue). The Secret Store CSI driver is using /etc/kubernetes/secrets-store-csi-providers as a rendezvous point for unix domain sockets with its various provider plugins.

As directed by Ben Cressey we are opening this issue to ask for a compatibility symlink from /etc/kubernetes/secrets-store-csi-providers to somewhere under /var

How to reproduce the problem:
Install the Secret Store CSI driver, install the AWS plugin, run kubctl logs on one of secrets-store-csi-driver-provider-aws instances.

[zmrow]

Thanks for opening this - we'll look into it!

[rverma-dev]

Can we cherry pick this fix in 1.0.8, its a blocker for us.

[jhaynes]

@rverma-nsl You're welcome to do the cherry-pick for a custom build if you'd like. However, we're slated to release 1.1.0 shortly which will have this fix in it. Hopefully you can upgrade to this 1.1.0 release and pick it up that way.